Windows operating systems

UWF (Unified Write Filter)

 
Note
Overfilled RAM overlay and disk overlay
The UWF is not suitable for continuous operation (24/7) without continuous monitoring and default settings. The RAM overlay, or disk overlay respectively, will grow continually up to the maximum preset size due to write accesses (even in excluded areas), until the write accesses fail. The operating system can then no longer be operated.

Windows write filters are tools specially developed by Microsoft Windows to protect a partition against write accesses. The advantage of a write filter is that the user can secure a partition in a preconfigured state. Following a restart, the system is automatically reset to the originally defined state.

The UWF (Unified Write Filter) is a write filter that is only installed with Windows 10. The user can control the UWF with the "Beckhoff Unified Write Filter Manager" via a graphical user interface. This software provides a simple configuration option. The full range of functions is available in the Windows command line and is described in detail in the Microsoft documentation:
https://docs.microsoft.com/en-us/windows-hardware/customize/enterprise/unified-write-filter

UWF Manager overview

The UWF mode, status and the size of the overlay can be set on the General tab. The write filter is activated or deactivated here.

 
 UWF_general
UWF Manager in RAM mode, partition C: non-protected.
Key to the UWF Manager.
No.
Description
1
The individual partitions can be protected via this button.
2
The current UWF mode, status and the size of the overlay are displayed here.
3
File and registry exclusions can be defined on these tabs.
4
The future status of the UWF is displayed here in case of changes. Switch between the RAM and disk mode using the Change button.
5
The size of the overlay can be set via this box.
 
 
 Diskmode
UWF Manager in disk mode, partition C: protected starting from the next restart.
Key to the colors of the UWF Manager.
No.
Description
1
Red = switched off, not protected
2
Green = switched on, protected
3
Yellow = switched on and protected after the next restart.

File Exclusions

On the File Exclusions tab, exceptions can be defined and write accesses to individual files or folders can be permitted.

 
 UWF_file_exclusions
File Exclusions of the UWF Manager.
 
 
Key to the UWF Manager (File Exclusions).
No.
Description
1
New folders can be added to the exclusions via this box.
2
Existing exclusions can be switched on or off via this button.

Registry Exclusions

Exceptions can be defined and write accesses to individual registry keys permitted on the Registry Exclusions tab.

 
 UWF_registry exclusions
Registry Exclusions of the UWF Manager.
Key to the UWF Manager (Registry Exclusions).
No.
Description
1
New registry keys can be added to the exclusions via this box.
2
Existing exclusions can be switched on or off via this button.

In the case of an active UWF, all write accesses to the RAM (RAM overlay) or the disk overlay respectively will be diverted and the partition will only be accessed for reading. Following a restart, Windows will start in the originally defined state again.

 
 UWF (Unified Write Filter) 1:
Windows Write Filter, mode of operation of an application software in RAM mode.

In addition, exceptions can be defined with the UWF and, as a result, write accesses to individual files, folders or registry keys permitted. Note that the exceptions will only be written to the partition following a restart and will be buffered in the RAM overlay or disk overlay until then.

The UWF is not suitable for continuous operation with default settings

The UWF is not suitable for continuous operation (24/7) with default settings. The RAM overlay, or disk overlay respectively, will grow continually up to the maximum preset size due to write accesses (even in excluded areas), until the write accesses fail. The overlay is only enabled again following a restart.

Irrespective of how large the RAM overlay or disk overlay is set, it may eventually fill up without a restart. The RAM overlay is particularly endangered, as it can account for a maximum of 50% of the total RAM. Further write attempts will fail if the RAM or disk overlay is full. In this state, your device may no longer react and may become sluggish. The disk overlay may be a solution, as a correspondingly large overlay can be generated with sufficient free memory.

See Microsoft documentation:
https://docs.microsoft.com/en-us/windows-hardware/customize/enterprise/uwfoverlay

Warnings with high utilization rate

The overlay load cannot be precisely predicted. The new UWF Manager optimizes the operating system for the use of the UWF, but it cannot ensure trouble-free 24/7 operation without exception. Messages are displayed for the user at a 50% and 70% utilization rate of the overlay. Be sure to heed these warnings.

General recommendation

1.
Do not use the UWF with RAM overlay in continuous operation (24/7 operation).
2.
The behavior of the UWF should be analyzed precisely before switching it on continuously in a system.

Recommendation for various application scenarios

Little data, sufficient RAM, little free space on the disk → RAM mode
Sufficient free space on the disk, possibly larger data quantities → disk mode
Large data quantities → create second volume for data, protect only C: with UWF