Reputation: 1
We are using the Unified Write Filter (UWF) to protect the c: drive in one of our applications. Typically, we observer the expected behavior when the UWF filter is enabled. However, we've encountered an issue where, on certain devices, we're unable to disable the UWF filter anymore.
Executing uwfmgr get-config
on these devices gives following output:
Unified Write Filter Configuration Utility version 10.0.17763
Copyright (C) Microsoft Corporation. All rights reserved.
Current Session Settings
FILTER SETTINGS
Filter state: OFF
Pending commit: N/A
Shutdown pending:No
SERVICING SETTINGS
Servicing State: OFF
OVERLAY SETTINGS
Type: RAM
Maximum size: 2048 MB
Warning Threshold: 2000 MB
Critical Threshold: 2048 MB
Freespace Passthrough: ON
Persistent: OFF
Reset Mode: N/A
VOLUME SETTINGS
Volume ba7185c2-0000-0000-0000-702200000000 [C:]
Volume state: Protected
Volume ID: ba7185c2-0000-0000-0000-702200000000
File Exclusions:
Current Session Exclusions for Volume ba7185c2-0000-0000-0000-702200000000 [C:]
*** No exclusions
Volume c8bc8700-0000-0000-0000-702200000000 [C:]
Volume state: Protected
Volume ID: c8bc8700-0000-0000-0000-702200000000
File Exclusions:
Current Session Exclusions for Volume c8bc8700-0000-0000-0000-702200000000 [C:]
*** No exclusions
REGISTRY EXCLUSIONS
*** No exclusions
Next Session Settings
FILTER SETTINGS
Filter state: OFF
Pending commit: N/A
SERVICING SETTINGS
Servicing State: OFF
OVERLAY SETTINGS
Type: RAM
Maximum size: 2048 MB
Warning Threshold: 2000 MB
Critical Threshold: 2048 MB
Freespace Passthrough: ON
Persistent: OFF
Reset Mode: N/A
VOLUME SETTINGS
Volume ba7185c2-0000-0000-0000-702200000000 [C:]
Volume state: Protected
Volume ID: ba7185c2-0000-0000-0000-702200000000
File Exclusions:
Next Session Exclusions for Volume ba7185c2-0000-0000-0000-702200000000 [C:]
*** No exclusions
Volume c8bc8700-0000-0000-0000-702200000000 [C:]
Volume state: Protected
Volume ID: c8bc8700-0000-0000-0000-702200000000
File Exclusions:
Next Session Exclusions for Volume c8bc8700-0000-0000-0000-702200000000 [C:]
*** No exclusions
REGISTRY EXCLUSIONS
*** No exclusions
We identified two issues there:
uwfmgr filter disable
reports that the filter is already disabled and that no action were taken.
uwfmgr filter enable
gets stuck indefinitely. The Event Viewer doesn't show any failures or errors.
In addition to these uwfmgr commands, we attempted to disable the UWF through Windows Features. Although we successfully unchecked the checkbox and received a prompt to restart, the UWF checkbox was reselected after the restart.
Upvotes: 0
Views: 130