Windows 10 IoT UWF File Exclusions and Subfolders don't get excluded.
I am running a Windows 10 IoT Enterprise LTSC 2021 device and running the UWF in RAM.
I was led to believe that if you add in any file exclusions of a type folder, then any subfolders beneath it, are also excluded.
This doesn't seem to be the case, I have the following exclusions in place, but every time I run a reboot and and scan the content of the overlay, it seems that content is being written to it, in these very folders and subfolders.
Here are the exclusions and here is some of the overlay content being created, even with these exclusions in place.
Exclusions
Current Session Settings
Current Session Exclusions for Volume b46d2214-7573-4617-8f88-266660f4486a [C:]
C:\TEMP
C:\Program Files (x86)\Microsoft\EdgeUpdate
C:\Program Files (x86)\Microsoft\EdgeCore
C:\Program Files (x86)\Microsoft\Edge
C:\Program Files (x86)\Microsoft\Edge\Application
C:\Program Files\Microsoft Defender
C:\ProgramData\Microsoft\Windows Defender
C:\Windows\WindowsUpdate.log
C:\Windows\Temp\MpCmdRun.log
C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\Cache
C:\Windows\System32\LogFiles
C:\Windows\System32\winevt\Logs
Yet the overlay shows that content was written to those areas, see below, particularly within the folders shown below.
C:\Windows\System32\winevt\Logs
\Windows\System32\winevt\Logs\Microsoft-Windows-PowerShell%4Operational.evtx::$DATA 4587520
\Windows\System32\winevt\Logs\Security.evtx::$DATA 176128
\Windows\System32\winevt\Logs:$I30:$INDEX_ALLOCATION 155648
\Windows\System32\winevt\Logs\Microsoft-Windows-Shell-Core%4Operational.evtx::$DATA 122880
\Windows\System32\winevt\Logs\Microsoft-Windows-Store%4Operational.evtx::$DATA 110592
\Windows\System32\winevt\Logs\Microsoft-Windows-LiveId%4Operational.evtx::$DATA 106496
\Windows\System32\winevt\Logs\Application.evtx::$DATA 94208
\Windows\System32\winevt\Logs\Windows PowerShell.evtx::$DATA 73728
\Windows\System32\winevt\Logs\Microsoft-Windows-GroupPolicy%4Operational.evtx::$DATA 69632
\Windows\System32\winevt\Logs\Microsoft-Windows-Windows Defender%4Operational.evtx::$DATA 69632
\Windows\System32\winevt\Logs\System.evtx::$DATA 69632
\Windows\System32\winevt\Logs\Microsoft-Windows-WMI-Activity%4Operational.evtx::$DATA 61440
C:\Program Files (x86)\Microsoft\Edge
\Program Files (x86)\Microsoft\EdgeCore\109.0.1518.70\msedge.dll::$DATA 282624
\Program Files (x86)\Microsoft\EdgeUpdate\Download{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\109.0.1518.70\MicrosoftEdge_X64_109.0.1518.70.exe::$DATA 114688
\Program Files (x86)\Microsoft\EdgeCore\109.0.1518.70\icudtl.dat::$DATA 53248
\Program Files (x86)\Microsoft\EdgeCore\109.0.1518.70\d3dcompiler_47.dll::$DATA 16384
\Program Files (x86)\Microsoft\EdgeCore\109.0.1518.70\ffmpeg.dll::$DATA 12288
\Program Files (x86)\Microsoft\EdgeCore\109.0.1518.70\libGLESv2.dll::$DATA 12288
\Program Files (x86)\Microsoft\EdgeCore\109.0.1518.70\mip_core.dll::$DATA 12288
\Program Files (x86)\Microsoft\Edge\Application\msedge.exe::$DATA 12288
Am I doing something fundamentally wrong here, or is there a real problem with the Windows 10 UWF?
Thanks in advance.
Jason