Windows 10 date and time management with UWF

Question

I have my Windows 10 device locked down with UWF (Unified Write Filter) feature. I noticed a strange behaviour when changing the system date and time while UWF is enabled and the volume C: is protected. In particular I noticed that when i change the system date/time I can't go back in time more than 26 hours before the date/time that was set on the system when the UWF filter was enable.

To be more clear:

• UWF filter is disabled
• I set the system date/time to 25/10/2017 23:00
• I enable UWF filter and restart
• After the restart I set the system date/time to 22/10/2017 16:30
• I restart the system
• after the restart the date/time has been automatically restored to 25/10/2017 23:00

This behaviour doesn't seem to be bound to the Time Zone set on the system.I tested the behaviour from UTC-12 to UTC+14 and the result is always the same.

Has anyone experienced a similar problem or knows the reason that UWF doesn't allow to go back more than 26 hours?

Edit 1: After further tests we discovered that the 26 hours limit is granted by the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\TimeZoneInformation\RealTimeIsUniversal when it is set to 1. If this key is not present or it's set to 0 then the hours limit varies depending on the Time Zone set on the system.

Answer 1

I found out that you can in fact set the time backwards with the UWF enabled, but not further than the time last set without the UWF filter.

So if you have a system with the date September 2. 2018 adn then set UWF enabled, you can set the time forward a few years, and then back again at a later time, but if you try to set it further back than September 2. 2018 that will not work without disabling the UWF and adjusting the time there.

If this is by deisgn or a bug i do not know, but I guess it has some value to avoid users of a system with UWF to set the time further back then the time the system was set to when they received it.

Answer 2

I can't comment or vote due to low rep but we have encountered this problem on both "Windows 8 Embedded Standard" and "Windows 10 v1607 LTSB Enterprise".

I don't have a solution, but this is our work-around...

We have a process in our factory which turns off the write filter, sets the time/date to somewhere in the year 2000 and then re-enables the write filter and flags the system such that when the customer receives it, the are forced to set the time/date for the first time. Note the flag and time/date UI upon first boot from factory is our own custom software.

This works because the time/date can be set forward (from time/date it was when the write filter was enabled) any amount, just not backwards.