Description: This article describes some general information on Embedded OS's and Endpoint Manager (EPM). It will cover configuring the two different types of write filters, setting up embedded OS's in a lab environment, and other information.
General Information - Embedded:
- Windows 10 IoT (formally Embedded) Core is not supported with a standard EPM agent. The core version only supports applications from the Windows Store. Managing the device with a mobility agent and MDM server would be recommended.
- Windows 10 IoT (formally Embedded) Enterprise is supported as it is the binary equivalent to Windows 10. Just to note...this version doesn't appear to be on MSDN subscriptions.
- If you are using a license from an MSDN (Microsoft Developer Network) subscription then licenses are trial and last only 180 days.
General Information - Write Filters:
- The commands in the screen shots below provide examples and switches as well as a quick definition of each write filter type.
- If you change the state of the write filter (Enabled to Disabled or Disabled to Enabled) it will take affect on the next reboot. See more examples below.
- A couple of times while working with write filters I had trouble disabling them manually. The following command helped: "ewfmgr.exe C: -CommitandDisable -live"
Enhanced Write Filter (EWF) = A component of Windows Embedded which stores volume changes on another medium instead of applying them to the original volume. Writes can then be discarded or committed to the original volume later.
Example screen shot when the command to disable the write filter is ran. Notice the "Boot Command" is now set to "Disabled". Note: Running this command without the "-disable" will report on the status of the write filter.
File Based Write Filter (FBWF) = Allows Windows Embedded to maintain the appearance of read and write access to write sensitive or read only storage. FBWF makes read and write access transparent to applications.
Unified Write Filter (UWF) = Operates at the sector level, intercepting all writes to a protected volume. However, you can specify that certain files, directories, or registry keys are excluded from being filtered.
Lab Example 1: Setting up Windows 7 Embedded as a virtual machine
VM Specifications Used:
|VM Software||VMWare Workstation 14|
|OS Selection||Windows 7 x 64|
|ISO Image||Windows Embedded Standard 7 SP1 Runtime|
- Create a virtual machine with the specifications above.
- Use the ISO "Windows 7 Embedded Standard Runtime". The SP1 version of this ISO will work as well.
- Boot the machine to the selected ISO
- Select "Build an Image"
- Accept the license agreement
- Select "Thin Client" from the "Use a template" option.
- Select a language
- Select "Next" on the features page
- Select "Next" on "Where do you want to install Windows?"
- Walk through the Out of Box Experience (OOBE) screens.
- Proceed to configure the write filter as instructed above.
Note: As noted above if you are using the MSDN license this will be a 180 day trial.
Additional Note: You can also separately install the write filters by not selecting a template. You will be prompted for features instead. See screen shot below:
Lab Example 2: Setting up Windows 10 IoT (Formally known as Embedded) Enterprise version (As noted above "Core" version is not supported if using a standard agent). This edition is the binary equivalent to Windows 10 Enterprise. The only difference is the license.
1- Install Windows 10 Enterprise Edition.
2- Enable the Unified Write Filter (UWF) as shown below.
3- Configure the UWF. Use the options displayed in the screen shot above. As noted more options are available for filtering certain files/folders. Reference online documentation for information on how to do this.