IBM Support

TEM and XP Embedded Write Filters

Technote (troubleshooting)


Problem(Abstract)

Windows Point of Sales systems TEM agent configuration

Resolving the problem

TEM and XP Embedded Write Filters

Windows Point of Sales systems (such as Windows XP Embedded, Windows Embedded Standard, WePOS, or POSReady 2009) are versions of Windows XP that may be configured to use write filter systems. A Write Filter redirects disk writes to temporary storage. This technique makes it temporarily appear that changes have successfully occurred, but in fact these changes are discarded on reboot. Write Filter technology must be managed in order to successfully configure and patch systems that have it activated. TEM offers analyses and tasks to work with Write Filters. Additionally, TEM offers a Write Filter wizard that enables creation of a filter-supported patching baseline.
Enhanced Write Filter Support
Enhanced Write Filters protect an entire volume with no granularity. To enable the TEM Agent to work with EWF, TEM must be installed to a volume without EWF enabled, and EWF must subsequently be disabled. Since writes to the registry are not preserved through reboots, EWF will cause unexpected and undesired behavior. TEM provides the following tasks to detect and control the state of Enhanced Write Filters.

  • Create or Update Enhanced Write Filter Log - This task is critical for Write Filter support of any kind and should be enabled on all point of sale systems
  • WARNING: Enhanced Write Filter is Enabled - This task allows disabling of EWF or locking of the TEM Agent
  • Disable Enhanced Write Filter
  • Enable Enhanced Write Filter
File Based Write Filter Support
File Based Write Filters also redirect the disk writes on a per volume basis, but allows configurable exceptions to be written to permanent disk. To use TEM on a volume protected with FBWF, the following exceptions need to be added.
  • "\Program Files\TEM Enterprise"
  • "\Windows\System32\config\SOFTWARE" (note that this will open the HKLM\Software key to change - for more granular control of the registry, use RegFilter in conjunction with FBWF)
TEM provides the following tasks to detect and control the state of File Based Write Filters:
  • Create or Update File-Based Write Filter Log - This task is critical for Write Filter support of any kind and should be enabled on all point of sale systems.
  • WARNING: File-Based Write Filter is Enabled and Not Configured for BES Compatibility - This task allows disabling of FBWF, exception configuration of FBWF, or locking of the TEM Agent.
  • Configure File-Based Write Filter for BES Compatibility
  • Disable File-Based Write Filter
  • Enable File-Based Write Filter
RegFilter Support
Registry Filters do not redirect disk writes, but do protect the registry from preserved writes in a similar fashion. To enable TEM agent on a system protected with RegFilter, the following exception needs to be added:
  • "Software\TEM"
TEM provides the following tasks to support RegFilter use:
  • WARNING: Registry Filter is Enabled and Not Configured for BES Compatibility - This task allows exception configuration of RF, or locking of the TEM Agent.
  • Configure Registry Filter for BES Compatibility
Filter Combinations
To use TEM with File-Based Write Filter and RegFilter (recommended), run these tasks:
1. Configure File-Based Write Filter for BES Compatibility
2. Configure Registry Filter for BES Compatibility
To use TEM with Enhanced Write Filter and Registry Filter, run these tasks:
1. Disable Enhanced Write Filter
2. Configure Registry Filter for BES Compatibility
To use TEM with Enhanced Write Filter and File-Based Write Filter, run these tasks:
1. Disable Enhanced Write Filter
2. Configure File-Based Write Filter for BES Compatibility
To get TEM working with EWF, FBWF, and RegFilter Components, run these tasks:
1. Disable Enhanced Write Filter
2. Configure File-Based Write Filter for BES Compatibility
3. Configure Registry Filter for BES Compatibility
Record Duplication in TEM
Write Filters that prevent persistent registry writes will cause the TEM Agent to lose synchronization with the Unified Management Platform on reboot, creating a duplicated record in the TEM database and console. If Write Filters are left on and un-configured, this duplication will occur repeatedly on every reboot. Because disabling a Write Filter or configuring exceptions in a Write Filter which allows exceptions does not take effect without reboot, the computers targeted by this action will produce duplicate records after the reboot occurs. The new records are the ones that should be used going forward, as they will not duplicate again unless the Write Filter configuration is changed.

To remove duplicate records, use the TEM Computer Remover tool from the TEM Utilities page. While it is possible to correctly configure write filters after installing TEM Agents, the best practice is to configure exceptions for TEM in the write filters before installing TEM. This prevents the creation of duplicate records. An ideal configuration is as follows:
1. In the Image creation tool, add File-Based Write Filter
2. Enter an FBWF exception for "\Program Files\TEM Enterprise"
3. Add RegFilter
4. Enter a RegFilter exception for "Software\TEM"
5. Optionally add the TEM Agent to the image before deploying (ensuring that the Client ID is removed). The Agent should be installed before enabling the filters..

Historical Number

1625

Document information

More support for: IBM BigFix family

Software version: Version Independent

Operating system(s): Platform Independent, Windows

Reference #: 1506200

Modified date: 31 July 2015


Translate this page: