Manage Windows 10 with Unified Write Filter enabled

There are lot of Blog Posts and TechNet Articles which explain how to use Unified Write Filter (UWF) together with ConfigMgr. But most of them are written for older ConfigMgr Versions like 2007. Now I had a project with ConfigMgr 2012 R2 SP1 and we found some interesting things, which are not documented. All existing documentations will tell you, that you need to set some exclusions for ConfigMgr in UWF. But when you do this, then the Software Center won’t work and the following error message is displayed:

There is a problem showing the current status. More information: Loading Software Center returned error code 0x87D00244 (-2016411068).

You will find perhaps the following TechNet Forum Entry which explains the behavior and recommends to not create any ConfigMgr related exclusions. But when you follow this advice you get the following problem:

The Content will be downloaded before the computer reboots and UWF is disabled. After the reboot the application can’t be installed because the Content is not available. This means, you need to configure your ccmcache Folder as UWF exclusion to solve the issue. I also recognized that we need other exclusions:

uwfmgr File add-exclusion "c:\Windows\ccmcache"
uwfmgr File add-exclusion "c:\_TaskSequence"
uwfmgr File add-exclusion "c:\Windows\BootStat.dat"

Additionally I faced two other problems with UWF:

• ConfigMgr doesn’t enable UWF automatically after an Application Installation has finished. I tried different settings, sometimes it worked, but sometimes not. So I decided to use a Task Sequence. ConfigMgr disabled UWF before the Task Sequence starts and I could enable UWF again in the second last step of the Task Sequence.

  uwfmgr.exe filter enable

  In the last step we initiate a reboot of the Computer.
  
  Tip: If you would like to prohibit logons to the client during Task Sequence, you can remove your user Accounts from the local User group and add them back after the servicing job is done, directly before the reboot is executed.

• My devices are domain joined and the devices should boot very fast. With this requirement I need my user profile generated before UWF is enabled the first time. So I enable UWF at the end of the OSD Task Sequence, but didn’t force a restart. I also set the Autologin for the primary user of this workstation. To have UWF enabled as fast as possible I wrote a short script which is executed when the first user is logged in and immediately reboots the computer.
   

I hope this tips will help you implementing UWF in your ConfigMgr environment.

• About
• Latest Posts

Follow me

Thomas Kurth

Principal Security Consultant | MVP at baseVISION AG

I’m a consultant, trainer and architect for modern workplace and enterprise mobility projects with Microsoft Technologies in the past ten years. I love to push and design the modern workplace based on Microsoft 365 for my customers which is the only answer for the current security threats, agile world and the fast-changing business requirements of my customers. Important for me is to simplify and automate the operational processes, because there are the highest costs.

Follow me

Latest posts by Thomas Kurth (see all)

• Microsoft Sentinel ASIM Parser demystified - March 31, 2024
• Enhancing Network Security Insights with IDS/IPS of Ubiquiti Dream Machine Pro and Microsoft Sentinel - March 10, 2024
• Ubiquiti Dream Machine Pro Logs to Microsoft Sentinel - February 6, 2024