EWF Ram-Reg and cloning

[Guest]

I recently reconfigured my SP2 system from remote boot to EWF Ram-Reg mode.
I followed the procedure described in "Configuring EWF RAM Reg Mode" at
http://msdn.microsoft.com/library/d...lp/html/xegrfconfiguringewframregoverlays.asp

After some confusion and pain, this procedure worked OK however I still lack
some understanding of what's happening at steps 13 and 14. Apparently EWF is
not active on the first boot after FBA (step 13) and "ewfmgr c:" only gives
the desired result after the second boot (step 14). Can I run step 13 on the
development machine even if I have the cloning component installed? I'm not
sure whether each machine would get a unique SID in that case.

This is important because I painfully discovered that I must perform an
extra step between steps 13 and 14. My application dynamically creates a
service. I found that by step 13 the service data had been written to the
registry and that when I ran my image on deployed devices the application
would fail when it tried to create the service because the service already
existed. Therefore I found that I need to delete the service before step 14.
You'll have to trust me that I have good reasons for only wanting the
service created dynamically. This problem did not occur with remote boot
because the registry was always volatile. It would not be good if I had to
delete the service individually from every deployed machine.

 

[KM]

sam,

I recently reconfigured my SP2 system from remote boot to EWF Ram-Reg mode.
I followed the procedure described in "Configuring EWF RAM Reg Mode" at
http://msdn.microsoft.com/library/d...lp/html/xegrfconfiguringewframregoverlays.asp

Unfortunately, this doc has some missing info. I couldn't find how one would
enable the EWF at runtime.
So, in Step#13 you should also set "Enabled" value to dword:0 under
[HKLM\SYSTEM\CurrentControlSet\Services\ewf\Parameters\Protected\Volume0]
key.
(or run ewfmgr c: -enable).

After some confusion and pain, this procedure worked OK however I still
lack
some understanding of what's happening at steps 13 and 14.

In MS guide nothing happens there but just some registry entries
verification. However, in reality you do want to enable EWF somewhere at
step #13.
What do you do there now?
Do you get EWF enabled on your golden image?

Apparently EWF is
not active on the first boot after FBA (step 13) and "ewfmgr c:" only
gives
the desired result after the second boot (step 14). Can I run step 13 on
the
development machine even if I have the cloning component installed? I'm
not
sure whether each machine would get a unique SID in that case.

I don't understand what you are reffering to here when you say "step 13"? In
the doc by the link you mentioned above the Step 13 is nothing more than
just a verification step to chekc some reg.entries.
What is a hurt to check the registry on any machine?

This is important because I painfully discovered that I must perform an
extra step between steps 13 and 14.

I can understand why you have to have an extra FBA step but why do you place
it after the Step13?
Is the EWF disabled or enabled after your step13? (see my comment above
about the value "Enabled").

My application dynamically creates a
service. I found that by step 13 the service data had been written to the
registry and that when I ran my image on deployed devices the application
would fail when it tried to create the service because the service already
existed. Therefore I found that I need to delete the service before step
14.
You'll have to trust me that I have good reasons for only wanting the
service created dynamically. This problem did not occur with remote boot
because the registry was always volatile. It would not be good if I had
to
delete the service individually from every deployed machine.

This article may also be helpful to you when you are dealing with EWF and
Cloning:
http://msdn.microsoft.com/library/e...esignConsiderationsForUsingEWFWithCloning.asp.
However, with EWF Ram Reg you don't have EWF hassle while cloning and it is
a straightforward process there.

KM

 

[Slobodan Brcin \(eMVP\)]

Sam,

Reg RAM EWF will not be active only in case that PnP detected new volume, only in this case you need to do one extra reboot.

Only two cases that I know when this will happen are:
1. First FBA (before first reboot). If FBA need two reboots then for second FBA reboot EWF will be enabled and you will have enldess
reboot loop. So if you have FBA with more reboots you will have to enable from FBA EWF at last FBA before reboot.
2. First boot on new disk after image copy. Volume that ewf driver is bound to will not exist anymore and User mode PnP must
reinstall new volume in registry. Only after reboot EWF driver will become aware of that change and start enabled.

Actualy this is not driver related but more filter driver related isuue and it is now windows work with upper class filter drivers.

Regards,
Slobodan