UWF (Unified Write Filter)

Notice

Overfilled RAM overlay and disk overlay

The UWF is not suitable for continuous operation (24/7) without continuous monitoring and default settings. The RAM overlay, or disk overlay respectively, will grow continually up to the maximum preset size due to write accesses (even in excluded areas), until the write accesses fail. The operating system can then no longer be operated.

The UWF (Unified Write Filter) is a write filter that is only installed with Windows 10. The user can control the UWF with the "Beckhoff Unified Write Filter Manager" via a graphical user interface. This software provides a simple configuration option. The full range of functions is available in the Windows command line and is described in detail in the Microsoft documentation:
https://docs.microsoft.com/de-de/windows-hardware/customize/enterprise/unified-write-filter

UWF Manager overview

The UWF mode, status and the size of the overlay can be set on the General tab. The write filter is enabled or disabled here.

UWF (Unified Write Filter) 1:
UWF manager in RAM mode, partition C: not protected.
Legend of the UWF Manager.

No.

Description

1

The individual partitions can be protected via this button.

2

The current UWF mode, status and the size of the overlay are displayed here.

3

File and registry exclusions can be defined on these tabs.

4

The future status of the UWF is displayed here in case of changes. Switch between the RAM and disk mode using the Change button.

5

The size of the overlay can be set via this box.

UWF (Unified Write Filter) 2:
UWF manager in disk mode, partition C: protected from next restart.
Legend to the colors of the UWF Manager.

No.

Description

1

Red = switched off, not protected

2

Green = switched on, protected

3

Yellow = switched on and protected after the next restart.

File Exclusions

On the File Exclusions tab, exceptions can be defined and write accesses to individual files or folders can be permitted.

UWF (Unified Write Filter) 3:
File Exclusions of the UWF Manager.
Legend to the UWF Manager (File Exclusions).

No.

Description

1

New folders can be added to the exclusions via this box.

2

Existing exclusions can be switched on or off via this button.

Registry Exclusions

Exceptions can be defined and write accesses to individual registry keys permitted on the Registry Exclusions tab.

UWF (Unified Write Filter) 4:
Registry Exclusions of the UWF Manager.
Legend to the UWF Manager (Registry Exclusions).

No.

Description

1

New registry keys can be added to the exclusions via this box.

2

Existing exclusions can be switched on or off via this button.

In the case of an active UWF, all write accesses to the main memory (RAM overlay) or the disk overlay respectively will be diverted and the partition will only be accessed for reading. Following a restart, Windows will start in the originally defined state again.

UWF (Unified Write Filter) 5:
Windows Write Filter, mode of operation of an application software in RAM mode.

In addition, exceptions can be defined with the UWF and, as a result, write accesses to individual files, folders or registry keys permitted. Note that the exceptions will only be written to the partition following a restart and will be buffered in the RAM overlay or disk overlay until then.

If large or a lot of data is written to the overlay by the system, this data should be defined as an exception in the UWF. The overlay memory and the files it contains can be analyzed using the Beckhoff UWF Manager to identify memory hogs. To do this, you must set the "Enable Overlay tracing" checkbox in the settings of the Beckhoff UWF Manager.

UWF (Unified Write Filter) 6:
UWF Manager settings
UWF (Unified Write Filter) 7:
UWF Manager "Enable Overlay tracing" checkbox

After a Windows restart with enabled UWF an additional tab appears in the Beckhoff UWF Manager, which lists the files and the associated file sizes in the overlay.

UWF (Unified Write Filter) 8:
UWF Manager Overlay consumption

The UWF is not suitable for continuous operation with default settings

The UWF is not suitable for continuous operation (24/7) with default settings. The RAM overlay, or disk overlay respectively, will grow continually up to the maximum preset size due to write accesses (even in excluded areas), until the write accesses fail. The overlay is only enabled again following a restart.

Irrespective of how large the RAM overlay or disk overlay is set, it may eventually fill up without a restart. The RAM overlay is particularly endangered, as it can account for a maximum of 50 % of the total main memory. Further write attempts will fail if the RAM or disk overlay is full. In this state, your device may no longer react and may become sluggish. The disk overlay may be a solution, as a correspondingly large overlay can be generated with sufficient free memory.

See Microsoft documentation:
https://docs.microsoft.com/en-us/windows-hardware/customize/enterprise/uwfoverlay

Warnings with high utilization rate

The overlay load cannot be precisely predicted. The new UWF Manager optimizes the operating system for the use of the UWF, but it cannot ensure trouble-free 24/7 operation without exception. Messages are displayed for the user at a 50 % and 70 % utilization rate of the overlay. Be sure to heed these warnings.

Backup & recovery with the UWF

Before a backup of a system is created, the UWF must be switched off in it. Otherwise, the UWF will be configured incorrectly in the restored system. After a backup has been restored, the UWF can be enabled again for the newly created volume.

General recommendation

  1. Do not use the UWF with RAM overlay in continuous operation (24/7 operation).
  2. The behavior of the UWF should be analyzed precisely before switching it on continuously in a system.

Recommendation for various application scenarios