KeyboardWarrior
KeyboardWarrior

Reputation: 1

Unified Write Filter cannot be disabled

We are using the Unified Write Filter (UWF) to protect the c: drive in one of our applications. Typically, we observer the expected behavior when the UWF filter is enabled. However, we've encountered an issue where, on certain devices, we're unable to disable the UWF filter anymore.

Executing uwfmgr get-config on these devices gives following output:

Unified Write Filter Configuration Utility version 10.0.17763
Copyright (C) Microsoft Corporation. All rights reserved.
Current Session Settings
FILTER SETTINGS
    Filter state:    OFF
    Pending commit:  N/A
    Shutdown pending:No
SERVICING SETTINGS
    Servicing State: OFF
OVERLAY SETTINGS
    Type:               RAM
    Maximum size:       2048 MB
    Warning Threshold:  2000 MB
    Critical Threshold: 2048 MB
    Freespace Passthrough: ON
    Persistent: OFF
    Reset Mode: N/A
VOLUME SETTINGS
Volume ba7185c2-0000-0000-0000-702200000000 [C:]
    Volume state:     Protected
    Volume ID:        ba7185c2-0000-0000-0000-702200000000
    File Exclusions:
Current Session Exclusions for Volume ba7185c2-0000-0000-0000-702200000000 [C:]
        *** No exclusions
Volume c8bc8700-0000-0000-0000-702200000000 [C:]
    Volume state:     Protected
    Volume ID:        c8bc8700-0000-0000-0000-702200000000
    File Exclusions:
Current Session Exclusions for Volume c8bc8700-0000-0000-0000-702200000000 [C:]
        *** No exclusions
REGISTRY EXCLUSIONS
    *** No exclusions
Next Session Settings
FILTER SETTINGS
    Filter state:    OFF
    Pending commit:  N/A
SERVICING SETTINGS
    Servicing State: OFF
OVERLAY SETTINGS
    Type:               RAM
    Maximum size:       2048 MB
    Warning Threshold:  2000 MB
    Critical Threshold: 2048 MB
    Freespace Passthrough: ON
    Persistent: OFF
    Reset Mode: N/A
VOLUME SETTINGS
Volume ba7185c2-0000-0000-0000-702200000000 [C:]
    Volume state:     Protected
    Volume ID:        ba7185c2-0000-0000-0000-702200000000
    File Exclusions:
Next Session Exclusions for Volume ba7185c2-0000-0000-0000-702200000000 [C:]
        *** No exclusions
Volume c8bc8700-0000-0000-0000-702200000000 [C:]
    Volume state:     Protected
    Volume ID:        c8bc8700-0000-0000-0000-702200000000
    File Exclusions:
Next Session Exclusions for Volume c8bc8700-0000-0000-0000-702200000000 [C:]
        *** No exclusions
REGISTRY EXCLUSIONS
    *** No exclusions

We identified two issues there:

uwfmgr filter disable reports that the filter is already disabled and that no action were taken. uwfmgr filter enable gets stuck indefinitely. The Event Viewer doesn't show any failures or errors.

In addition to these uwfmgr commands, we attempted to disable the UWF through Windows Features. Although we successfully unchecked the checkbox and received a prompt to restart, the UWF checkbox was reselected after the restart.

Upvotes: 0

Views: 130

Answers (0)

Related Questions