Unified Write Filter: What It Is & How It Works

A Unified Write Filter (UWF) is a Windows feature that redirects all disk writes to a virtual overlay, so the underlying storage stays untouched and returns to its original state after a reboot. You enable it on a device, choose which drives or volumes to protect, and then any changes—new files, settings, malware—are discarded when the PC restarts. It is built into Windows 10 and 11 Enterprise and Education editions, and it is the modern replacement for the older Enhanced Write Filter (EWF) used in Windows Embedded.

Formula

The Unified Write Filter uses a simple capacity model: the overlay can only be as large as the smaller of the configured overlay size and the available RAM (minus a safety margin). The formula is:

Usable overlay = min(Configured overlay size, 0.75 × RAM)

• Configured overlay size – the maximum MB you set with uwfmgr overlay set-size (default is 1024 MB).
• RAM – total physical memory on the device, in MB.
• 0.75 – a conservative safety factor; Windows reserves some RAM for the OS and other processes, so the overlay cannot consume all memory.

The result is the practical limit of writes you can make before the overlay fills and the system forces a restart or fails a write.

Worked Example

Using the defaults from the calculator: overlay size = 1024 MB, RAM = 4096 MB.

1. Compute 75% of RAM: 0.75 × 4096 = 3072 MB.
2. Compare with the configured overlay: min(1024, 3072) = 1024 MB.
3. So the usable overlay is 1024 MB, which is 25% of RAM (1024 / 4096 × 100).

In this case the overlay size is the limiting factor. If you had only 1024 MB of RAM, the usable overlay would drop to 768 MB (0.75 × 1024), because RAM becomes the bottleneck.

Why UWF Exists and When to Use It

UWF is designed for kiosks, digital signage, point-of-sale terminals, hospital workstations, and any PC that must stay in a known-good state. It is not meant for everyday desktops or laptops where you want to keep files and settings across reboots. The key benefit is protection: if a user downloads a malicious file or a Windows update breaks a driver, a simple restart wipes the change and the system boots exactly as it was configured.

It also extends the life of solid-state drives (SSDs) and SD cards by reducing write wear. Because all writes go to RAM (or a disk-backed overlay), the underlying flash storage is not constantly rewritten. This is why UWF is popular on thin clients and embedded devices with limited flash.

How UWF Works Under the Hood

When UWF is enabled on a volume, the filter driver sits between the file system and the disk driver. Every write request is intercepted and redirected to a temporary overlay file. The overlay can be stored in RAM (fast but volatile) or on a separate disk volume (slower but survives a power loss). Reads are also intercepted: if the file was modified in the overlay, the overlay version is returned; otherwise the original disk version is used.

At reboot, the overlay is discarded unless you have configured persistent overlays (available on some versions) or you explicitly commit changes with uwfmgr file commit. The commit command writes selected files or directories from the overlay to the real disk, making them permanent. This lets you apply updates or install software and then lock the system again.

How to Enable and Configure UWF

UWF is disabled by default. You enable it from an elevated command prompt or PowerShell. The main commands are:

1. Open Command Prompt as Administrator.
2. Type uwfmgr.exe filter enable and press Enter. Reboot the PC.
3. After reboot, protect a volume: uwfmgr.exe volume protect C:
4. Set the overlay size (optional): uwfmgr.exe overlay set-size 2048 (in MB).
5. Reboot again for changes to take effect.

To check status: uwfmgr.exe get-config. To disable: uwfmgr.exe filter disable and reboot. Note that UWF can only be managed with these commands; there is no graphical control panel in Windows.

Common Problems and Misconceptions

The biggest misconception is that UWF is a security tool like antivirus. It is not—it is a state-reset tool. Malware can still run during a session and steal data; UWF only ensures it disappears on reboot. It does not prevent infection or data theft in real time.

Another common issue is the overlay filling up. If you install a large application or download many files, the overlay can hit its limit. When that happens, Windows may show a warning, and if the overlay is full, writes fail or the system forces a restart. This is why you need to estimate your write volume and set the overlay size accordingly.

Also, UWF does not protect against firmware-level attacks or physical theft. And it does not work with BitLocker on the same volume unless you configure it carefully—BitLocker encrypts the disk, and UWF intercepts writes, which can cause conflicts. Microsoft recommends testing combinations.

UWF vs. Other Write Protection Methods

UWF is often compared to:

• Enhanced Write Filter (EWF) – the older Windows Embedded feature. EWF uses a RAM or disk overlay but lacks the finer-grained volume control and the ability to protect specific files. UWF is faster and more flexible.
• Write-protect switches on SD cards and USB drives – hardware-level, no software involved. UWF is more granular but depends on the OS.
• Deep Freeze and similar third-party tools – commercial software that does the same thing. UWF is free if you have Enterprise/Education, but third-party tools often add a GUI and scheduling.
• Windows System Protection (System Restore) – this saves snapshots of system files, not a live overlay. It requires manual restore and consumes disk space.

For most enterprise kiosk scenarios, UWF is the most cost-effective because it is already in the OS.

Costs and Requirements

UWF is included in Windows 10/11 Enterprise and Education editions. It is not available in Home or Pro. If your organization already has Enterprise licensing, there is no extra cost. For smaller businesses on Pro, you would need to upgrade to Enterprise or use a third-party tool.

Hardware requirements are modest: at least 1 GB of RAM for the overlay (more if you plan to write large files), and enough disk space for the overlay if you use a disk-backed overlay. A 64-bit CPU is recommended. There is a small performance overhead for every write, typically a few percent, but reads are unaffected.

Safety and Best Practices

Before enabling UWF, always back up the system and test on a non-production device. Because UWF discards all changes on reboot, you can lose unsaved work if you forget to commit files. Best practices include:

• Always commit critical data before rebooting: uwfmgr.exe file commit C:\path\to\file.
• Set a reasonable overlay size (at least 1 GB for typical kiosks).
• Monitor overlay usage with uwfmgr.exe overlay get-usage.
• Disable UWF before applying Windows updates, then re-enable after.
• Do not use UWF on a system that needs to retain user profiles or logs.

If you are using UWF on a device that also runs antivirus, make sure the antivirus definitions are committed or stored on a separate unprotected volume, otherwise they will be lost on reboot.

Frequently Asked Questions

Does UWF protect against ransomware?

It can help, but not fully. If ransomware encrypts files during a session, a reboot restores the original state, so the damage is undone. However, the ransomware could also steal data or persist in the overlay if it survives the reboot (some variants write to the overlay and then trigger a reboot). UWF is not a substitute for a real security suite.

Can I use UWF on Windows 10 Home?

No. UWF is only in Enterprise and Education editions. Home and Pro do not include it. You can enable it by upgrading the edition, but that requires a license change.

Will UWF slow down my computer?

Writes are slightly slower because they go through the filter driver and into RAM. Reads are usually unaffected. In practice, the overhead is small (a few percent) for typical workloads. If you use a disk-backed overlay, writes are slower than RAM but still acceptable.

How do I make a file permanent after enabling UWF?

Use the command uwfmgr.exe file commit <path> to write a specific file from the overlay to the real disk. For directories, use uwfmgr.exe file commit <directory> /recursive. You must run these commands as Administrator.

What happens if the overlay fills up?

When the overlay reaches its limit, Windows will warn you. If you continue, writes will fail, and the system may become unstable. The safest action is to reboot to clear the overlay, or increase the overlay size if you need more space.

Can I use UWF with BitLocker?

Yes, but with caution. Both features intercept disk I/O, and there are known conflicts. Microsoft recommends enabling BitLocker first, then UWF, and testing thoroughly. In some configurations, you may need to exclude the BitLocker system volume from UWF protection.

Related

• Format a Resume Recruiters Can Scan Quickly
• Cheap Keyboards Worth Considering by Typing Style
• Shortcuts for Borders? Quick Ways to Cross Faster

in overlay | Overlay size (MB) | MB | 1024 | 1 | 1048576
in ram | RAM available (MB) | MB | 4096 | 1 | 1048576
out usable | Usable overlay (MB) | MB | min(overlay, ram * 0.75) | 0
out percent | RAM used by overlay | % | (overlay / ram) * 100 | 1