Write Protect your Run-Time Image with EWF

  • Article

You can prevent accidental writes, attacks, or other harmful access to your run-time image by implementing the Enhanced Write Filter. Enhanced Write Filter intercepts all writes made to a run-time image and stores them in an alternate storage area. This storage area is called an overlay, and can be a separate partition on a disk, or in RAM.

For more information, see Enhanced Write Filter.

Note   Enhanced Write Filter should not be used as an anti-virus solution. Worms and viruses can spread quickly throughout a network, and even if a run-time image is protected with EWF, a virus can still infect it. Because the virus is stored in the EWF overlay, the virus will continue to propagate to other systems. Even if the overlay is discarded when the system reboots, other systems on the network can continue to infect your run-time image. If an EWF overlay is committed to the protected volume, the system will become infected.

See Also

Best Practices for Security | Network Security Considerations | Local Security Considerations

Last updated on Wednesday, October 18, 2006

© 2006 Microsoft Corporation. All rights reserved.