Share via

Install Updates on an EWF-Protected Run-Time Image (Standard 7 SP1)

  • Article

7/8/2014

Because Enhanced Write Filter (EWF) prohibits write access to a volume, there are additional considerations to make when you want to install an application or update your run-time image.

Warning

When a write filter (EWF or FBWF) is enabled, Offline servicing (booting up into WinPE and using Deployment Image Servicing and Management (DISM) to update the system) must not be used. Performing such servicing may result in unpredictable behavior that varies from problems booting up the system to updates not being applied.

To disable the current EWF overlay, use the ewfmgr disable command. After you disable the EWF overlay, you must restart the system and then install your application.

Note

For EWF RAM Reg mode, you must use the ewfmgr commitanddisable command to disable EWF. The ewfmgr commitanddisable command applies all changes in the overlay to the protected volume, even those that are unrelated to your application installation or update. To minimize additional write operations to your volume, you can clear the overlay cache by restarting the device before you install any applications. For more information, see EWF RAM Reg Mode.

Additionally, you can use the EWF API functions to programmatically control EWF Manager to disable EWF. For more information about how to use the EWF APIs, see EWF API.

To apply an update, you must use one of the following procedures.

To update a run-time image that is protected by EWF RAM mode

  1. Use EWF Manager to disable the overlay by typing the following command:

    ewfmgr c: -disable

  2. Restart the system.

  3. Install the application or update.

  4. Wait for the install to complete and restart the computer if required.

  5. Re-enable the EWF overlay by using the following command:

    ewfmgr c: -enable

  6. Restart the system to re-enable the EWF overlay.

To update a run-time image that is protected by EWF RAM Reg mode

  1. Restart the device to clear the RAM overlay.

  2. Commit the overlay to the protected volume and disable the EWF overlay by typing the following command:

    ewfmgr c: -commitanddisable

    Because RAM Reg modes store EWF configuration data in the registry, you must commit the disable change to the protected run-time image. For more information, see Configure EWF RAM Reg Mode.

  3. Restart the system to disable the overlay.

  4. Install the application or update.

  5. Wait for the install to complete and restart the computer if required.

  6. Enable the EWF overlay by typing the following command:

    ewfmgr c: -enable

  7. Restart the system to re-enable the EWF overlay.

See Also

Other Resources

Enhanced Write Filter with HORM
Troubleshooting EWF
EWF Design Considerations