המדריך המקצועי ל-Unified Write Filter ב-Windows

(Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion").ProductName
cscript.exe //Nologo "$env:SystemRoot\System32\slmgr.vbs" /xpr

Enable-WindowsOptionalFeature -Online -FeatureName Client-UnifiedWriteFilter -All -NoRestart

dism.exe /online /Enable-Feature /FeatureName:Client-UnifiedWriteFilter /All /NoRestart

Get-WindowsOptionalFeature -Online -FeatureName Client-UnifiedWriteFilter

uwfmgr.exe get-config

uwfmgr.exe overlay set-type disk
uwfmgr.exe overlay set-size 16384
uwfmgr.exe overlay set-warningthreshold 13107
uwfmgr.exe overlay set-criticalthreshold 14745

uwfmgr.exe overlay set-passthrough on

uwfmgr.exe volume protect C:

uwfmgr.exe volume get-config all

New-Item -Path "C:\ProgramData\MyApp\Persistent" -ItemType Directory -Force
uwfmgr.exe file add-exclusion "C:\ProgramData\MyApp\Persistent"

uwfmgr.exe file get-exclusions all
uwfmgr.exe registry get-exclusions

uwfmgr.exe file add-exclusion "C:\Program Files\Windows Defender"
uwfmgr.exe file add-exclusion "C:\ProgramData\Microsoft\Windows Defender"
uwfmgr.exe file add-exclusion "C:\Windows\WindowsUpdate.log"
uwfmgr.exe file add-exclusion "C:\Windows\Temp\MpCmdRun.log"

uwfmgr.exe registry add-exclusion "HKLM\SOFTWARE\Microsoft\Windows Defender"
uwfmgr.exe registry add-exclusion "HKLM\SYSTEM\CurrentControlSet\Services\WdBoot"
uwfmgr.exe registry add-exclusion "HKLM\SYSTEM\CurrentControlSet\Services\WdFilter"
uwfmgr.exe registry add-exclusion "HKLM\SYSTEM\CurrentControlSet\Services\WdNisSvc"
uwfmgr.exe registry add-exclusion "HKLM\SYSTEM\CurrentControlSet\Services\WdNisDrv"
uwfmgr.exe registry add-exclusion "HKLM\SYSTEM\CurrentControlSet\Services\WinDefend"

$Namespace = "root\standardcimv2\embedded"

$UwfReg = Get-CimInstance `
    -Namespace $Namespace `
    -ClassName UWF_RegistryFilter |
    Where-Object { $_.CurrentSession -eq $false }

Set-CimInstance `
    -InputObject $UwfReg `
    -Property @{ PersistDomainSecretKey = $true }

Get-CimInstance `
    -Namespace "root\standardcimv2\embedded" `
    -ClassName UWF_RegistryFilter |
Select-Object CurrentSession, PersistDomainSecretKey

Test-ComputerSecureChannel -Verbose

uwfmgr.exe registry add-exclusion "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones"
uwfmgr.exe registry add-exclusion "HKLM\SYSTEM\CurrentControlSet\Control\TimeZoneInformation"

powercfg.exe /h off
uwfmgr.exe filter enable
uwfmgr.exe get-config

uwfmgr.exe filter restart

uwfmgr.exe get-config
uwfmgr.exe volume get-config all
uwfmgr.exe overlay get-config
uwfmgr.exe overlay get-consumption
uwfmgr.exe overlay get-availablespace
uwfmgr.exe file get-exclusions all
uwfmgr.exe registry get-exclusions
uwfmgr.exe servicing get-config

uwfmgr.exe filter disable
uwfmgr.exe filter restart

uwfmgr.exe filter enable
uwfmgr.exe filter restart

uwfmgr.exe file add-exclusion "C:\Windows\SoftwareDistribution"
uwfmgr.exe file add-exclusion "C:\ProgramData\Microsoft\Network\Downloader"

uwfmgr.exe registry add-exclusion "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate"
uwfmgr.exe registry add-exclusion "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate"

uwfmgr.exe file add-exclusion "C:\Program Files\Google\Chrome\Application"
uwfmgr.exe file add-exclusion "C:\Program Files (x86)\Google\Chrome\Application"
uwfmgr.exe file add-exclusion "C:\Program Files (x86)\Google\GoogleUpdater"
uwfmgr.exe file add-exclusion "C:\Program Files (x86)\Google\Update"

uwfmgr.exe registry add-exclusion "HKLM\SOFTWARE\Google\Update"
uwfmgr.exe registry add-exclusion "HKLM\SOFTWARE\WOW6432Node\Google\Update"
uwfmgr.exe registry add-exclusion "HKLM\SOFTWARE\Policies\Google\Update"

uwfmgr.exe file add-exclusion "C:\Program Files (x86)\Microsoft\EdgeUpdate"
uwfmgr.exe file add-exclusion "C:\Program Files (x86)\Microsoft\Edge\Application"
uwfmgr.exe file add-exclusion "C:\Program Files\Microsoft\Edge\Application"

uwfmgr.exe registry add-exclusion "HKLM\SOFTWARE\Policies\Microsoft\EdgeUpdate"
uwfmgr.exe registry add-exclusion "HKLM\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate"
uwfmgr.exe registry add-exclusion "HKLM\SYSTEM\CurrentControlSet\Services\edgeupdate"
uwfmgr.exe registry add-exclusion "HKLM\SYSTEM\CurrentControlSet\Services\edgeupdatem"

#Requires -RunAsAdministrator
param(
    [switch]$StartMaintenance
)

$ErrorActionPreference = "Stop"
$Namespace = "root\standardcimv2\embedded"
$BasePath = "C:\ProgramData\MorNet\UWF-Maintenance"
$StateFile = Join-Path $BasePath "state.json"
$LogFile = Join-Path $BasePath "maintenance.log"
$UwfMgr = "$env:SystemRoot\System32\uwfmgr.exe"
$MaxPasses = 4

New-Item -Path $BasePath -ItemType Directory -Force | Out-Null

function Write-MaintenanceLog {
    param([string]$Message)
    $Line = "{0:u} {1}" -f (Get-Date), $Message
    Add-Content -LiteralPath $LogFile -Value $Line -Encoding UTF8
}

function Save-State {
    param(
        [string]$Phase,
        [int]$Pass
    )

    [pscustomobject]@{
        Phase = $Phase
        Pass  = $Pass
    } | ConvertTo-Json | Set-Content -LiteralPath $StateFile -Encoding UTF8
}

function Get-State {
    if (-not (Test-Path -LiteralPath $StateFile)) {
        return $null
    }

    Get-Content -LiteralPath $StateFile -Raw | ConvertFrom-Json
}

function Restart-WithUwf {
    Write-MaintenanceLog "Restart requested through UWF."
    & $UwfMgr filter restart
    exit
}

function Install-WindowsUpdates {
    Write-MaintenanceLog "Starting Windows Update Agent scan."

    $Session = New-Object -ComObject "Microsoft.Update.Session"
    $Session.ClientApplicationID = "MorNet UWF Maintenance"

    $Searcher = $Session.CreateUpdateSearcher()
    $SearchResult = $Searcher.Search(
        "IsInstalled=0 and IsHidden=0 and Type='Software'"
    )

    $Updates = New-Object -ComObject "Microsoft.Update.UpdateColl"

    foreach ($Update in $SearchResult.Updates) {
        if (-not $Update.EulaAccepted) {
            $Update.AcceptEula()
        }

        [void]$Updates.Add($Update)
        Write-MaintenanceLog ("Selected update: " + $Update.Title)
    }

    if ($Updates.Count -eq 0) {
        Write-MaintenanceLog "No applicable Windows updates found."
        return [pscustomobject]@{
            Count = 0
            RebootRequired = $false
        }
    }

    $Downloader = $Session.CreateUpdateDownloader()
    $Downloader.Updates = $Updates
    $DownloadResult = $Downloader.Download()

    Write-MaintenanceLog (
        "Download result code: " + $DownloadResult.ResultCode
    )

    $Installer = $Session.CreateUpdateInstaller()
    $Installer.Updates = $Updates
    $InstallResult = $Installer.Install()

    Write-MaintenanceLog (
        "Install result code: " + $InstallResult.ResultCode +
        ", reboot required: " + $InstallResult.RebootRequired
    )

    return [pscustomobject]@{
        Count = $Updates.Count
        RebootRequired = [bool]$InstallResult.RebootRequired
    }
}

try {
    $Filter = Get-CimInstance `
        -Namespace $Namespace `
        -ClassName UWF_Filter

    $State = Get-State

    if ($StartMaintenance -and -not $State) {
        Save-State -Phase "Requested" -Pass 0
        $State = Get-State
        Write-MaintenanceLog "Maintenance requested."
    }

    if (-not $State) {
        exit 0
    }

    if ($Filter.CurrentEnabled) {
        if ($State.Phase -eq "EnablePending") {
            Write-MaintenanceLog "UWF protection restored. Maintenance completed."
            Remove-Item -LiteralPath $StateFile -Force -ErrorAction SilentlyContinue
            exit 0
        }

        Write-MaintenanceLog "Disabling UWF for the next session."
        Save-State -Phase "FilterDisablePending" -Pass ([int]$State.Pass)
        & $UwfMgr filter disable
        Restart-WithUwf
    }

    $State = Get-State

    if (-not $Filter.CurrentEnabled) {
        $Pass = [int]$State.Pass + 1
        Save-State -Phase "Updating" -Pass $Pass

        Write-MaintenanceLog "Update pass $Pass of $MaxPasses."
        $Result = Install-WindowsUpdates

        if ($Result.RebootRequired -and $Pass -lt $MaxPasses) {
            Write-MaintenanceLog "Windows Update requires another restart."
            Restart-WithUwf
        }

        if ($Result.Count -gt 0 -and $Pass -lt $MaxPasses) {
            Write-MaintenanceLog "Updates were installed. Rebooting for another scan."
            Restart-WithUwf
        }

        Write-MaintenanceLog "Enabling UWF for the next session."
        Save-State -Phase "EnablePending" -Pass $Pass
        & $UwfMgr filter enable
        Restart-WithUwf
    }
}
catch {
    Write-MaintenanceLog ("ERROR: " + $_.Exception.Message)

    try {
        $Filter = Get-CimInstance `
            -Namespace $Namespace `
            -ClassName UWF_Filter

        if (-not $Filter.CurrentEnabled) {
            Save-State -Phase "EnablePending" -Pass 99
            & $UwfMgr filter enable
            Restart-WithUwf
        }
    }
    catch {
        Write-MaintenanceLog ("RECOVERY ERROR: " + $_.Exception.Message)
    }

    throw
}

New-Item -Path "C:\ProgramData\MorNet\UWF-Maintenance" -ItemType Directory -Force

uwfmgr.exe file add-exclusion "C:\ProgramData\MorNet\UWF-Maintenance"

powershell.exe -NoProfile -ExecutionPolicy Bypass -File "C:\ProgramData\MorNet\UWF-Maintenance\Invoke-UwfMaintenance.ps1" -StartMaintenance

$Script = "C:\ProgramData\MorNet\UWF-Maintenance\Invoke-UwfMaintenance.ps1"

$Action = New-ScheduledTaskAction `
    -Execute "powershell.exe" `
    -Argument "-NoProfile -ExecutionPolicy Bypass -File `"$Script`""

$Trigger = New-ScheduledTaskTrigger -AtStartup

$Principal = New-ScheduledTaskPrincipal `
    -UserId "SYSTEM" `
    -LogonType ServiceAccount `
    -RunLevel Highest

$Settings = New-ScheduledTaskSettingsSet -StartWhenAvailable

Register-ScheduledTask `
    -TaskName "MorNet-UWF-Maintenance-Startup" `
    -Action $Action `
    -Trigger $Trigger `
    -Principal $Principal `
    -Settings $Settings `
    -Force

uwfmgr.exe file commit "C:\Path\To\File.txt"

uwfmgr.exe registry commit "HKLM\SOFTWARE\ExampleKey"

uwfmgr.exe overlay get-config
uwfmgr.exe overlay get-consumption
uwfmgr.exe overlay get-availablespace

$Namespace = "root\standardcimv2\embedded"

$Overlay = Get-CimInstance `
    -Namespace $Namespace `
    -ClassName UWF_Overlay

$OverlayConfig = Get-CimInstance `
    -Namespace $Namespace `
    -ClassName UWF_OverlayConfig |
    Where-Object { $_.CurrentSession -eq $true }

if ($OverlayConfig.MaximumSize -gt 0) {
    $Percent = [math]::Round(
        ($Overlay.OverlayConsumption / $OverlayConfig.MaximumSize) * 100,
        1
    )

    [pscustomobject]@{
        ConsumptionMB = $Overlay.OverlayConsumption
        MaximumMB     = $OverlayConfig.MaximumSize
        AvailableMB   = $Overlay.AvailableSpace
        Percent       = $Percent
    }
}

$Namespace = "root\standardcimv2\embedded"

$Overlay = Get-CimInstance `
    -Namespace $Namespace `
    -ClassName UWF_Overlay

$OverlayConfig = Get-CimInstance `
    -Namespace $Namespace `
    -ClassName UWF_OverlayConfig |
    Where-Object { $_.CurrentSession -eq $true }

if ($OverlayConfig.MaximumSize -le 0) {
    exit 0
}

$Percent = ($Overlay.OverlayConsumption / $OverlayConfig.MaximumSize) * 100

if ($Percent -ge 90) {
    msg.exe * "המחשב יבצע אתחול בעוד 60 שניות לצורך ניקוי סביבת UWF. שמרו את העבודה."
    Start-Sleep -Seconds 60
    uwfmgr.exe filter restart
}

uwfmgr.exe filter disable
uwfmgr.exe get-config
uwfmgr.exe filter restart

uwfmgr.exe filter reset-settings

uwfmgr.exe overlay set-persistent on

uwfmgr.exe overlay reset-persistentstate on

powercfg.exe /h on
uwfmgr.exe filter enable
uwfmgr.exe volume protect all
uwfmgr.exe filter restart

uwfmgr.exe get-config
uwfmgr.exe filter enable-horm
shutdown.exe /h