Blog Post

Security, Compliance, and Identity Blog
8 MIN READ

How to Manage Windows Embedded Write Filters Using System Center 2012 Configuration Manager

yvetteomeally's avatar
yvetteomeally
Icon for Microsoft rankMicrosoft
Sep 08, 2018
First published on CloudBlogs on Jul, 20 2012

Note: The article below refers to System Center 2012 Configuration Manager RTM with no service pack applied.  For information about managing embedded devices with write filters using Configuration Manager with Service Pack 1 or later, refer to this article instead.

This blog will introduce the prerequisites for installing the System Center 2012 Configuration Manager client on Windows Embedded Devices, provides a sample script that you can use with Configuration Manager to automatically disable and enable the Windows Embedded Write Filter and the step by step guidance on how to deploy software or software update to writer filter enabled Windows Embedded Devices with System Center 2012 Configuration Manager.

For System Center Configuration Manager 2007, we have the following documents related on how to manage Windows Embedded write filters:

Most of the content still applies for System Center 2012 Configuration Manager. However, we found there is some content which needs to be updated:

  • The script need to be updated to work on Windows Embedded Standard 7
  • When you’re using File-Based Write Filter, you need to add some additional registries and file exceptions in the Windows Devices image.
  • When you’re using File-Based Write Filter, there is a script that is required to be run on the local system at shutdown.  This script will commit the SMSTSVolumeID file generated by a Task Sequence ConfigMgr restart to the FBWF.  If this file isn’t committed, prior to the restart after running the Write Filter Disable command, the ConfigMgr Task Sequence will not continue after the machine has rebooted.

Prerequisites for Installing the System Center 2012 Configuration Manager Client on Windows Embedded Devices

Prerequisites when Using File-Based Write Filter

Configure the following exclusions if you want to use File-Based Write Filter (FBWF) to persist the state of the System Center 2012 Configuration Manager client between device restarts.

Registry Exceptions

Configure the following registry exclusions using the Embedded Designer as you create your image:

  • HKLMSoftwareMicrosoftSMS
  • HKLMSoftwareMicrosoftCCM

Configure the following exclusions if you are using task sequences to manage the Configuration Manager client.

  • HKLMSoftwareMicrosoftWindows NTCurrentVersionWinLogon
  • HKLMSystemCurrentControlSetServicessmstsmgr

File Exceptions

Configure the following file exceptions using File-Based Write Filter after installing the System Center 2012 Configuration Manager client:

  • %WINDIR% System32CCM
  • %WINDIR% System32Wbem

Configure the following exceptions if you are using task sequences to service the Configuration Manager client.

  • %SystemDrive _SMSTaskSequence
  • %WINDIR% BootStat.dat
  • %WINDIR% RegFData

For detailed information about building images and configuring write filters, see the Windows Embedded documentation.

Example Script for Configuring Write Filters Using System Center 2012 Configuration Manager on Windows Embedded Devices

Download the sample script from here: http://technet.microsoft.com/en-us/library/bb932156.aspx

If you want to use the script on a computer running Windows Embedded Standard 7 (WES 7) with Enhanced Write Filter (EWF), edit the script as follows:

Find the following line in the script:

if (bIsEWFInstalled) AND (InStr(strLine, "Device Name")) Then

Change “Device Name” to “Volume Name” as shown in the following example:

if (bIsEWFInstalled) AND (InStr(strLine, "Volume Name ")) Then

Note: This edit is needed because the location of the ewfmgr.exe command output is changed between WES 2009 and WES 7. The following code shows the  Ewfmgr.exe command output location for WES 2009 and WES 7.

Ewfmgr.exe command output on WES 2009.

Ewfmgr.exe command output on WES 7

How to Manage Windows Embedded Write Filters Using System Center 2012 Configuration Manager

To use the script and perform software distribution and software updates management using System Center 2012 Configuration Manager on Windows Embedded devices that use the Enhanced Write Filter (EWF) or File-Based Write Filter (FBWF) write filter, you must take the following steps:

  1. Create a software distribution package for deployment of the VBScript that contains the following programs:
    • Program 1: Issues the command to disable the write filter.
    • Program 2: Issues the command to enable the write filter.
  2. Create a custom task sequence that performs the following tasks:
    • Run Program 1 to disable the write filter.
    • Perform the required software distribution and software update activities.
    • Run Program 2 to enable the write filter.
  3. Deploy the task sequence to devices in your organization.

Use the following procedures to create a software distribution package and programs containing the sample script and to create and deploy the task sequence to install the script on Windows Embedded devices in your organization.

To create a software distribution package

  1. Save  the script that you downloaded (and updated if necessary) as a text file named XPeWriteFilters.vbs .
  2. In the Configuration Manager console, click Software Library .
  3. In the Software Library workspace, expand Application Management , and then click Packages.
  4. On the Home tab, in the Create group, click Create Package to open the Create Package and Program Wizard.
  5. On the General page, specify the following settings and optional settings, and then click Next.
    • Name: Specify the that is used to reference the packag
    • This package contains source files : Select this checkbox and specify the location where the script file XPeWriteFilters.vbs is located.
  6. On the Program Type page, select Do note create a program, click Next
  7. Complete the wizard.

Use one of the following procedures to create a program for the software distribution package.

To create a program to run the VBScript in disable mode

  1. In the Configuration Manager console, click Software Library .
  2. In the Software Library workspace, expand Application Management , and then click Packages.
  3. In the Packages node, select the package that you created by using the Create a software distribution package procedure, and then click Create Program .
  4. In the Program Type page, select Standard program , and then click Next .
  5. In the Standard Program page, specify the following settings, and then click Next .
    • Name : Specify Disable write filter .
    • Command line : Specify wscript.exe XPeWriteFilter.vbs DISABLE
    • Program can run : Specify Whether or not a user is logged on .
  6. Complete the wizard.
  7. Select the Program that you just created.
  8. On the Home tab, in the Properties group, click Properties .
  9. In the Properties dialog box, specify the following properties, and then click OK .
    • On the General tab, in After running specify Configuration Manager restarts computer .
    • On the Advanced tab, select Allow this program to be installed from the Install Package task sequence without being deployed .

To create a program to run the VBScript in enable mode

  1. In the Configuration Manager console, click Software Library .
  2. In the Software Library workspace, expand Application Management , and then click Packages.
  3. In the Packages node, select the package that you created by using the Create a software distribution package procedure, and then click Create Program .
  4. In the Program Type page, select Standard program , and then click Next .
  5. In the Standard Program page, specify the following settings, and then click Next .
    • N ame : Specify Enable write filter .
    • Command line : Specify wscript.exe XPeWriteFilter.vbs ENABLE .
    • Program can run : Specify Whether or not a user is logged on .
  6. Complete the wizard.
  7. Select the Program that you just created.
  8. On the Home tab, in the Properties group, click Properties .
  9. In the Properties dialog box, specify the following properties, and then click OK .
    • On the General tab, in After running specify Configuration Manager restarts computer .
    • On the Advanced tab, select Allow this program to be installed from the Install Package task sequence without being deployed .

To create a task sequence

  1. In the Configuration Manager console, click Software Library .
  2. In the Software Library workspace, expand Operating Systems , and then click Task Sequences .
  3. On the Home tab, in the Create group, click Create Task Sequence to start the Create Task Sequence Wizard.
  4. On the Create New Task Sequence page, select Create a new custom task sequence , and then click Next .
  5. On the Specify Task Sequence Information page, specify a name and optional comment for the task sequence, and then click Next . Do not specify a boot image. Boot images are needed only when deploying an operating system.
  6. Complete the wizard.

To edit a task sequence

  1. In the Configuration Manager console, click Software Library .
  2. In the Software Library workspace, expand Operating Systems , and then click Task Sequences .
  3. Select the task sequence that you want to edit.
  4. On the Home tab, in the Task Sequence group, click Edit to open the Task Sequence Editor .
  5. To add a step that sets the default scripting host, click Add , select General , and then click Run Command Line .
  6. In the Run Command Line step, on the Properties tab, specify the following command in the Command line box: cscript.exe //b //H:cscript
  7. To add a step that disables the write filter, click Add , select General , and then click Install Package .
  8. In the Install Package step, on the Properties tab, specify the package that contains the XPeWriteFilter.vbs script.
  9. From the Program drop-down list, select the program Disable write filter .
  10. Add additional steps to install software or software updates, as required.
  11. To add a step that enables the write filter, click Add , select General , and then click Install Package .
  12. In the Install Package step, on the Properties tab, specify the package that contains the XPeWriteFilter.vbs script.
  13. From the Program drop-down list, select the program Enable write filter .
  14. Click OK to save the changes and close the Task Sequence Editor.

To deploy a task sequence

  1. In the Configuration Manager console, click Software Library .
  2. In the Software Library workspace, expand Operating Systems , and then click Task Sequences .
  3. Select the task sequence that you want to deploy.
  4. On the Home tab, in the Deployment group, click Deploy to open the Deploy Software Wizard.
  5. On the General page, select the Collection that contains the embedded devices, and then click Next .
  6. On the Deployment Settings page, click Next .
  7. Complete the remaining pages of the Deploy Software Wizard according to your standard software distribution procedures.

The task sequence will run on the targeted computers. When the task sequence runs it will, disable the write filter, install the required software or updates, and then enable the write filter after the installation is complete.

For a File-based write filter (FBWF), you need to do some additional steps besides the script and task sequence:

When using the FBWF, there is a script that is required to run on the local system at shutdown. This script needs to commit the SMSTSVolumeID file that is generated by a task sequence initiated Configuration Manager restart to the FBWF. If the task sequence runs the Write Filter Disable command and this file is not committed prior to the restart, the task sequence will not continue after the computer restarts. To enable this script, it should be added to the Local Group Policy as a Shutdown script.

Use the following procedure to set the Shutdown script.

To set the Shutdown script

  1. The sample CommitVolID.vbs script is :
    Set WshShell = WScript.CreateObject("WScript.Shell") Set FSO = CreateObject("Scripting.FileSystemObject")   strCommand = "C:WindowsSystem32fbwfmgr.exe" strDir = "C:"   Set colDir = FSO.GetFolder(strDir) For Each objItem In colDir.Files If LCase(left(Cstr(objItem.Name), 10)) = "_smstsvolu" Then smsvolID = objItem.Name End If Next   strCommitCommand = strCommand & " /commit C: " & smsvolID   If NOT smsvolID = "" Then Set oExec = WshShell.Exec(strCommitCommand) 'Wait for the previous command to complete. Do While oExec.Status = 0 WScript.Sleep 100 Loop End If

  2. Copy the text and save it as CommitVolID.vbs.
  3. On the test computer, open the Run dialog, type MMC to open the Microsoft Management Console .
  4. Click File , and then and Select Add/Remove Snap – in .
  5. In the Add/Remove Snap-in dialog box, click Add .
  6. On the Add Standalone Snap-in page, select Group Policy Object Editor , click Add .
  7. On the Select Group Policy Wizard, click Finish .
  8. Click OK.
  9. In the MMC, expand the Local Computer Policy , and navigate to Computer Configuration/Windows Settings/Scripts(Startup/Shutdown) .
  10. In the right pane, double-click Shutdown .
  11. In the Shutdown Properties , click Add to add the script CommitVolID.vbs.

-- Minfang Lv

This posting is provided "AS IS" with no warranties and confers no rights.

Published Sep 08, 2018
Version 1.0
No CommentsBe the first to comment