Unified Write Filter
What it does:
Unified Write Filter (UWF) is an optional Windows 10 feature that helps to protect your drives by intercepting and redirecting any writes to the drive (app installations, settings changes, saved data) to a virtual overlay. The virtual overlay is a temporary location that is usually cleared during a reboot or when a guest user logs off.
When using ConfigMgr Remote Control and the Unified Write Filter, you may need to add a firewall rule to allow TCP2701 inbound.
Navigate to the Unified Write Filter by right clicking on a device or device collection > Recast RCT > Unified Write Filter:
Manage UWF Profiles:
The Manage Profiles menu allows users to create a set of saved configurations. The buttons above the profiles menu allow users to creete a new profile, delete an existing profile and copy, import and export existing profiles.
Unified Write Filter Profile:
Specific files or folders on a protected volume can be added to a file exclusion list in order to exclude those files and folders from being filtered by UWF. When a file or folder is in the exclusion list for a volume, all writes to that file or folder bypass UWF filtering, and are written directly to the protected volume and persist after the device restarts.
An administrator account must be used to add or remove file or folder exclusions during run time, and the device must be restarted for new exclusions to take effect.
- The drop-down list provides prepackaged exclusions for the following paths:
- ConfigMgr Client
- Trend Micro
- Users can also add custom file paths or registry keys the list.
- Cache Options allows users to specify where temporary changes are written (memory or disk) and the overall cache size.
Apply UWF Profile:
The Apply Profile Menu allows users to select a UWF profile for deployment.
Once a profile has been selected, users can either deploy a profile immediately or schedule a future deployment date.
- Once a profile has been deployed, the following dialogue box will show the status of the deployment:
Unified Write Filter Status:
The Unified Write Filter Status Tool displays information about the current UWF state for a device or device collection including:
- Excluded file paths and registry keys
- Overlay Type
- Overlay Maximum Size
- Individual windows for Current and Next Sessions
Install Unified Write Filter:
The Remove Profile Status Tool allows users to immediately remove deployed Unifed Write Filter Profiles or set a scheduled removal date.
Disable Unified Write Filter:
The Scheduled Tasks Tool shows which Unifed Write Filter Profiles are scheduled for deployment.