3 Replies Latest reply on Oct 8, 2009 8:28 AM by sriley

    Landesk and Enhanced Write Filter.


      We have a large number of Windows XP Embedded based thin clients. (wyse v90)

      These all use MS Enhanced write filter.  We also have a few older clients that use Wyse's write filter.

      All the clients have a LANDesk agent installed.


      What I want to know, is there any way for me to configure Landesk to be able to tell me if the write filter is on or off? (monitoring, alerts, reports, I don't care)


      We are using LDMS 8.8 SP3.

        • 1. Re: Landesk and Enhanced Write Filter.
          sriley SupportEmployee

          I am not too familar with the Wyse devices. Do they happen to have registry's on them, and if so, is there something in the registry that would tell you if that filter was on or off? If they have a registry, and if you can find that registry key, then you could do some registry scanning on those machines and bring back that information in the inventory so that you could query, or report on them. Here's a useful article on how to setup registry scanning. I know this is for a different registry key, but will give you an idea on how to do it:





          1 of 1 people found this helpful
          • 2. Re: Landesk and Enhanced Write Filter.

            In answer to you question SRR, they do have registry's as they are running windows XP embedded 


            I have done some more research.


            On older Wyse Thin clients (not SP2) use Wyse's own tools for Write protecting the system and it appears that the information is stored in a special partition on the disk.


            On Thin clients with newer images (XPe SP2 or higher) they have switched to using Microsoft's Enhance Write Filter (EWF)

            This write filter can be used in a number of ways:  DISK, RAM & RAM reg.   The first two modes store the EWF volume on Disk and the last one stores it in the registry.   http://msdn.microsoft.com/en-us/library/ms912906(WinEmbedded.5).aspx


            On the clients that we have most are using the older XPe but will be updated to the newer as we reimage them.  That means we can use your solution to monitor if the Write Filter is On or Off.


            My additions to the ldappl3.template file are as follows:


            ;Microsoft EWF settings
            KEY=HKLM,SYSTEM\CurrentControlSet\Services\EWF\Parameters\Protected\Volume0,Enabled,OS - XPembedded - Microsoft EWF Filter state


            The values for this key are 0= Write filter disabled 1=write filter enabled.  One consideration is that the key can be changed repeatedly using the ewfmgr command but does not come into effect uless the system is rebooted... In Wyse's case they have hidden the command behing a shortcut that runs a batch file that also reboots the client.


            This change may be one to put in Landesk permanantly as it applies to any WindowsXP embedded system utilising EWF.


            One thing I found was that in your Doc-6212, because of the font, It took a while to realise that the /I=HTTP://Your Core name here/ldlogon/ldappl3.ldz is using a lowercase L (el)  and not a capital I (eye)


            Thanks for the help

            • 3. Re: Landesk and Enhanced Write Filter.
              sriley SupportEmployee

              Anytime. Thanks for the additional information.