UWF (Unified Write Filter)
Notice | |
Overfilled RAM overlay and disk overlay The UWF is not suitable for continuous operation (24/7) without continuous monitoring and default settings. The RAM overlay, or disk overlay respectively, will grow continually up to the maximum preset size due to write accesses (even in excluded areas), until the write accesses fail. The operating system can then no longer be operated. |
The UWF (Unified Write Filter) is a write filter that is only installed with Windows 10. The user can control the UWF with the "Beckhoff Unified Write Filter Manager" via a graphical user interface. This software provides a simple configuration option. The full range of functions is available in the Windows command line and is described in detail in the Microsoft documentation:
https://docs.microsoft.com/de-de/windows-hardware/customize/enterprise/unified-write-filter
UWF Manager overview
The UWF mode, status and the size of the overlay can be set on the General tab. The write filter is activated or deactivated here.
No. | Description |
|---|---|
1 | The individual partitions can be protected via this button. |
2 | The current UWF mode, status and the size of the overlay are displayed here. |
3 | File and registry exclusions can be defined on these tabs. |
4 | The future status of the UWF is displayed here in case of changes. Switch between the RAM and disk mode using the Change button. |
5 | The size of the overlay can be set via this box. |
No. | Description |
|---|---|
1 | Red = switched off, not protected |
2 | Green = switched on, protected |
3 | Yellow = switched on and protected after the next restart. |
File Exclusions
On the File Exclusions tab, exceptions can be defined and write accesses to individual files or folders can be permitted.
No. | Description |
|---|---|
1 | New folders can be added to the exclusions via this box. |
2 | Existing exclusions can be switched on or off via this button. |
Registry Exclusions
Exceptions can be defined and write accesses to individual registry keys permitted on the Registry Exclusions tab.
No. | Description |
|---|---|
1 | New registry keys can be added to the exclusions via this box. |
2 | Existing exclusions can be switched on or off via this button. |
In the case of an active UWF, all write accesses to the main memory (RAM overlay) or the disk overlay respectively will be diverted and the partition will only be accessed for reading. Following a restart, Windows will start in the originally defined state again.
In addition, exceptions can be defined with the UWF and, as a result, write accesses to individual files, folders or registry keys permitted. Note that the exceptions will only be written to the partition following a restart and will be buffered in the RAM overlay or disk overlay until then.
If large or a lot of data is written to the overlay by the system, this data should be defined as an exception in the UWF. The overlay memory and the files it contains can be analyzed using the Beckhoff UWF Manager to identify memory hogs. To do this, you must set the "Enable Overlay tracing" checkbox in the settings of the Beckhoff UWF Manager.
After a Windows restart with enabled UWF an additional tab appears in the Beckhoff UWF Manager, which lists the files and the associated file sizes in the overlay.
The UWF is not suitable for continuous operation with default settings
The UWF is not suitable for continuous operation (24/7) with default settings. The RAM overlay, or disk overlay respectively, will grow continually up to the maximum preset size due to write accesses (even in excluded areas), until the write accesses fail. The overlay is only enabled again following a restart.
Irrespective of how large the RAM overlay or disk overlay is set, it may eventually fill up without a restart. The RAM overlay is particularly endangered, as it can account for a maximum of 50% of the total main memory. Further write attempts will fail if the RAM or disk overlay is full. In this state, your device may no longer react and may become sluggish. The disk overlay may be a solution, as a correspondingly large overlay can be generated with sufficient free memory.
See Microsoft documentation:
https://docs.microsoft.com/en-us/windows-hardware/customize/enterprise/uwfoverlay
Warnings with high utilization rate
The overlay load cannot be precisely predicted. The new UWF Manager optimizes the operating system for the use of the UWF, but it cannot ensure trouble-free 24/7 operation without exception. Messages are displayed for the user at a 50% and 70% utilization rate of the overlay. Be sure to heed these warnings.
Backup & recovery with UWF
Before creating a backup of a system, the UWF in it must be turned off. Otherwise, there will be an incorrect configuration of the UWF in the restored system. After a backup has been restored, the UWF can then be reactivated for the newly created volume.
General recommendation
- Do not use the UWF with RAM overlay in continuous operation (24/7 operation).
- The behavior of the UWF should be analyzed precisely before switching it on continuously in a system.
Recommendation for various application scenarios
- Little data, sufficient RAM, little free space on the disk → RAM mode
- Sufficient free space on the disk, possibly larger data quantities → disk mode
- Large data quantities → create second volume for data, protect only C: with UWF