FBWF and RegFilter not Persisting Registry Change across reboots

P

PJC

All

I am using FBWF protecting my system drive. I have configured keys in
RegFilter to monitor Reg Keys allowing me to persist a changes in the
IP address and my touch screen calibration.

I read KM's blog article on how to persist the IP address across
reboots but am having no luck

After a reboot, neither changing the IP address from DCHP to static or
static to static (new address) nor touch screen calibration persists.

Can anyone advise how to debug whether RegFilter is working?

My FBWF config is:

File-based write filter configuration for the current session:
filter state: enabled.
overlay cache data compression state: disabled.
overlay cache threshold: 64 MB.
overlay cache pre-allocation: enabled.
size display: actual mode.
protected volume list:
\Device\HarddiskVolume1
write through list of each protected volume:
\Device\HarddiskVolume1: (none)

File-based write filter configuration for the next session:
filter state: enabled.
overlay cache data compression state: disabled.
overlay cache threshold: 64 MB.
overlay cache pre-allocation: enabled.
size display: actual mode.
protected volume list:
\Device\HarddiskVolume1
write through list of each protected volume:
\Device\HarddiskVolume1: (none)

C:\WINDOWS\system32>

MY RegFilter entries are:



[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\RegFilter\Parameters
\MonitoredKeys]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\RegFilter\Parameters
\MonitoredKeys\0]
"ClassKey"="HKLM"
"FileNameForSaving"="TCPIP.rgf"
"RelativeKeyName"="SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\
\Interfaces\\{69978527-CBF4-48F1-BF1A-54371D56DE3A}]"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\RegFilter\Parameters
\MonitoredKeys\1]
"ClassKey"="HKLM"
"FileNameForSaving"="TCPIP2.rgf"
"RelativeKeyName"="SYSTEM\\CurrentControlSet\\Services\\Tcpip\
\Parameters\\Interfaces\\{69978527-CBF4-48F1-BF1A-54371D56DE3A}]"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\RegFilter\Parameters
\MonitoredKeys\2]
"ClassKey"="HKLM"
"FileNameForSaving"="ELO.rgf"
"RelativeKeyName"="SYSTEM\\CurrentControlSet\\Enum\\SERENUM\\ELOSERIAL\
\5&23de782&0&0000\\Device Parameters"

I have changed the TCPIP service startup to "2" as recommended by KM.



THANKS!!
 
P

PJC

Any suggestions??

Just I note - I have searched google, the XPE newsgroup and the KM
blog
 
J

JS

did you configure RegFilter in target designer?
(ie create the RegFilter registry keys before FBWF is enabled?)


PJC said:
Any suggestions??

Just I note - I have searched google, the XPE newsgroup and the KM
blog

All

I am using FBWF protecting my system drive. I have configured keys in
RegFilter to monitor Reg Keys allowing me to persist a changes in the
IP address and my touch screen calibration.

I read KM's blog article on how to persist the IP address across
reboots but am having no luck

After a reboot, neither changing the IP address from DCHP to static or
static to static (new address) nor touch screen calibration persists.

Can anyone advise how to debug whether RegFilter is working?

My FBWF config is:

File-based write filter configuration for the current session:
filter state: enabled.
overlay cache data compression state: disabled.
overlay cache threshold: 64 MB.
overlay cache pre-allocation: enabled.
size display: actual mode.
protected volume list:
\Device\HarddiskVolume1
write through list of each protected volume:
\Device\HarddiskVolume1: (none)

File-based write filter configuration for the next session:
filter state: enabled.
overlay cache data compression state: disabled.
overlay cache threshold: 64 MB.
overlay cache pre-allocation: enabled.
size display: actual mode.
protected volume list:
\Device\HarddiskVolume1
write through list of each protected volume:
\Device\HarddiskVolume1: (none)

C:\WINDOWS\system32>

MY RegFilter entries are:

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\RegFilter\Parameters
\MonitoredKeys]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\RegFilter\Parameters
\MonitoredKeys\0]
"ClassKey"="HKLM"
"FileNameForSaving"="TCPIP.rgf"
"RelativeKeyName"="SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\
\Interfaces\\{69978527-CBF4-48F1-BF1A-54371D56DE3A}]"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\RegFilter\Parameters
\MonitoredKeys\1]
"ClassKey"="HKLM"
"FileNameForSaving"="TCPIP2.rgf"
"RelativeKeyName"="SYSTEM\\CurrentControlSet\\Services\\Tcpip\
\Parameters\\Interfaces\\{69978527-CBF4-48F1-BF1A-54371D56DE3A}]"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\RegFilter\Parameters
\MonitoredKeys\2]
"ClassKey"="HKLM"
"FileNameForSaving"="ELO.rgf"
"RelativeKeyName"="SYSTEM\\CurrentControlSet\\Enum\\SERENUM\\ELOSERIAL\
\5&23de782&0&0000\\Device Parameters"

I have changed the TCPIP service startup to "2" as recommended by KM.

THANKS!!
Click to expand...
Click to expand...
 
P

PJC

I configured RegFilter manually adding registry keys after having
disabled FBWF and rebooting.

Does RegFilter only work if configured through Target Designer?


did you configure RegFilter in target designer?
(ie create the RegFilter registry keys before FBWF is enabled?)




Any suggestions??
Click to expand...
Just I note - I have searched google, the XPE newsgroup and the KM
blog
Click to expand...
All
I am using FBWF protecting my system drive. I have configured keys in
RegFilter to monitor Reg Keys allowing me to persist a changes in the
IP address and my touch screen calibration.
I read KM's blog article on how to persist the IP address across
reboots but am having no luck
After a reboot, neither changing the IP address from DCHP to static or
static to static (new address) nor touch screen calibration persists.
Can anyone advise how to debug whether RegFilter is working?
My FBWF config is:
File-based write filter configuration for the current session:
filter state: enabled.
overlay cache data compression state: disabled.
overlay cache threshold: 64 MB.
overlay cache pre-allocation: enabled.
size display: actual mode.
protected volume list:
\Device\HarddiskVolume1
write through list of each protected volume:
\Device\HarddiskVolume1: (none)
File-based write filter configuration for the next session:
filter state: enabled.
overlay cache data compression state: disabled.
overlay cache threshold: 64 MB.
overlay cache pre-allocation: enabled.
size display: actual mode.
protected volume list:
\Device\HarddiskVolume1
write through list of each protected volume:
\Device\HarddiskVolume1: (none)
C:\WINDOWS\system32>
MY RegFilter entries are:
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\RegFilter\Parameters
\MonitoredKeys]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\RegFilter\Parameters
\MonitoredKeys\0]
"ClassKey"="HKLM"
"FileNameForSaving"="TCPIP.rgf"
"RelativeKeyName"="SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\
\Interfaces\\{69978527-CBF4-48F1-BF1A-54371D56DE3A}]"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\RegFilter\Parameters
\MonitoredKeys\1]
"ClassKey"="HKLM"
"FileNameForSaving"="TCPIP2.rgf"
"RelativeKeyName"="SYSTEM\\CurrentControlSet\\Services\\Tcpip\
\Parameters\\Interfaces\\{69978527-CBF4-48F1-BF1A-54371D56DE3A}]"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\RegFilter\Parameters
\MonitoredKeys\2]
"ClassKey"="HKLM"
"FileNameForSaving"="ELO.rgf"
"RelativeKeyName"="SYSTEM\\CurrentControlSet\\Enum\\SERENUM\\ELOSERIAL\
\5&23de782&0&0000\\Device Parameters"
I have changed the TCPIP service startup to "2" as recommended by KM.
THANKS!!- Hide quoted text -
Click to expand...
Click to expand...

- Show quoted text -
Click to expand...
 
S

Sean Liming \(MVP\)

I think you need to set it up via Target Designer so the keys get created in
the ram file.

--
Regards,

Sean Liming
www.sjjmicro.com / www.seanliming.com
Book Author - XP Embedded Advanced, XP Embedded Supplemental Toolkit
PJC said:
I configured RegFilter manually adding registry keys after having
disabled FBWF and rebooting.

Does RegFilter only work if configured through Target Designer?


did you configure RegFilter in target designer?
(ie create the RegFilter registry keys before FBWF is enabled?)




Any suggestions??
Click to expand...
Just I note - I have searched google, the XPE newsgroup and the KM
blog
Click to expand...
All
Click to expand...
I am using FBWF protecting my system drive. I have configured keys in
RegFilter to monitor Reg Keys allowing me to persist a changes in the
IP address and my touch screen calibration.
Click to expand...
I read KM's blog article on how to persist the IP address across
reboots but am having no luck
Click to expand...
After a reboot, neither changing the IP address from DCHP to static or
static to static (new address) nor touch screen calibration persists.
Click to expand...
Can anyone advise how to debug whether RegFilter is working?
Click to expand...
My FBWF config is:
Click to expand...
File-based write filter configuration for the current session:
filter state: enabled.
overlay cache data compression state: disabled.
overlay cache threshold: 64 MB.
overlay cache pre-allocation: enabled.
size display: actual mode.
protected volume list:
\Device\HarddiskVolume1
write through list of each protected volume:
\Device\HarddiskVolume1: (none)
Click to expand...
File-based write filter configuration for the next session:
filter state: enabled.
overlay cache data compression state: disabled.
overlay cache threshold: 64 MB.
overlay cache pre-allocation: enabled.
size display: actual mode.
protected volume list:
\Device\HarddiskVolume1
write through list of each protected volume:
\Device\HarddiskVolume1: (none)
C:\WINDOWS\system32>
Click to expand...

MY RegFilter entries are:
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\RegFilter\Parameters
\MonitoredKeys]
Click to expand...
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\RegFilter\Parameters
\MonitoredKeys\0]
"ClassKey"="HKLM"
"FileNameForSaving"="TCPIP.rgf"
"RelativeKeyName"="SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\
\Interfaces\\{69978527-CBF4-48F1-BF1A-54371D56DE3A}]"
Click to expand...
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\RegFilter\Parameters
\MonitoredKeys\1]
"ClassKey"="HKLM"
"FileNameForSaving"="TCPIP2.rgf"
"RelativeKeyName"="SYSTEM\\CurrentControlSet\\Services\\Tcpip\
\Parameters\\Interfaces\\{69978527-CBF4-48F1-BF1A-54371D56DE3A}]"
Click to expand...

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\RegFilter\Parameters
\MonitoredKeys\2]
"ClassKey"="HKLM"
"FileNameForSaving"="ELO.rgf"
"RelativeKeyName"="SYSTEM\\CurrentControlSet\\Enum\\SERENUM\\ELOSERIAL\
\5&23de782&0&0000\\Device Parameters"
Click to expand...
I have changed the TCPIP service startup to "2" as recommended by KM.
Click to expand...
THANKS!!- Hide quoted text -
Click to expand...

- Show quoted text -
Click to expand...
Click to expand...
 
R

Rajan Purnanand

Joined
Nov 12, 2021
Messages
1
Reaction score
0
Sean Liming \(MVP\) said:
I think you need to set it up via Target Designer so the keys get created in
the ram file.

--
Regards,

Sean Liming
www.sjjmicro.com / www.seanliming.com
Book Author - XP Embedded Advanced, XP Embedded Supplemental Toolkit
Click to expand...
Dear sir,
i tried to disable state it show after disable command it will disable after next reboot but it doesn't work, how can i disable and open for all help me
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Similar Threads

EWF RAM reg mode and the Registry Filter 1
How do I get FBWF to enable? 1
Registry Filter - How does it work? 4
FBWF and Registry Filter (Changing IP Address) 11
FBWF and non persistent registry settings across reboot. 4
Disable EWF operation hang in RAM Reg mode of Removable CF. 1
Windows slow to load and ultra slow to shut-down 3
Can't Ping My Own IP Address - Part 2 3

Top