Reply To: XPe SP2 Write Filter

#8738
Anonymous
Member
  • Total Post: 162
  • Jacked into The Matrix
  • ★★★★★★

Hi Mate,

Thanks for your help with it. I’ve now sussed it out I think:

These instructions are based on the Wyse 9450XE Terminal with the 20Gb Factory HDD option fitted and Wyse XPe SP2 Build 425 (the latest download from the Wyse website).

After re-imaging to XPe SP2 via the Wyse Simple Imager (or Rapport – whatever flavour you like) you will end up with a 966mb partition (C: ) and a 17.6Gb partition (Y: by default).

To enable the EWF on the second partition you must make the following modifications:

1. Registry

Navigate to HKLMSystemCurrentControlSetControlServicesEWFParametersProtected

In here you will find a key called Volume0 with the following values:

“ArcName”=”multi(0)disk(0)rdisk(0)partition(2)”
“Enabled”=dword:00000000
“Type”=dword:00000001
“VolumeID”=”{1EA414D1-6760-4625-8CBE-4F9F85A48E15}”

What you need to do is create another key under the Protected key called Volume1 with the following values:

“ArcName”=”multi(0)disk(0)rdisk(0)partition(3)”
“Enabled”=dword:00000000
“Type”=dword:00000001
“VolumeID”=”{1EA414D1-6760-4625-8CBE-4F9F85A48E15}”

The reason it is Partition(3) is that the 17.6Gb partition has the ID of 3. To find out the partition ID if you don’t know, simply use the diskpart.exe tool.

2. Write Filter Enable/Disable Scripts

ThinkThin: I hope it is ok to post the contents of these scripts, if not please remove them

Wyse have two shortcuts on the Administrators desktop by default to control the Write Filter named Write Filter Enable and Write Filter Disable.

These two shotcuts call their respective batch file which in turn calls ewfmgr.exe and instructs it to either enable or flush and disable the Write Filter.

Here are the contents of the modified files. Essentially you just have to add a new line to get ewfmgr.exe to activate the write filter on the second partition which is called Y: in keeping with its default drive letter (obviously you change this depending on what you have called the second partition).

These two batch files are located in c:windowssystem32

wfon.bat
@c:windowssystem32ewfmgr c: -enable
@c:windowssystem32ewfmgr y: -enable
@shutdown -r -t 00

wfoff.bat
@c:windowssystem32ewfmgr c: -commitanddisable
@c:windowssystem32ewfmgr y: -commitanddisable
@shutdown -r -t 00

So all you have to do is modify 2 files and add a registry key and you have Write Filter protection for your second partition on XPe SP2!

Thanks to TT as always for your help 🙂

Cheers

-p