Example Script for Configuring Write Filters Using Configuration Manager 2007 on Windows Embedded Devices

Option Explicit
On Error Resume Next
'#--------------------------------------------------------------------------------------------
'# 
'#  This VBScript is used to allow software installation and update to a Windows Embedded
'#  client that is using EWF or FBWF protection on the drive.
'#
'#  Full documentation on the use of this VBScript is included in a separate document.
'#
'#--------------------------------------------------------------------------------------------

Dim gWshShell                                        'WScript.Shell object
Dim strProtectedDrive : strProtectedDrive = null     'The drive shown. by EWF or FBWF as being protected
Dim gSystemDrive                                     'Contains the System Drive (e.g. C:).
Dim strDisableCommand : strDisableCommand = null     'Either the EWF or FBWF command to disable the write filter.
Dim strEnableCommand  : strEnableCommand = null      'Either the EWF or FBWF command to enable the write filter.
Dim bIsWFEnabled : bIsWFEnabled = false              'Boolean for write filter enabled/disabled. 
Dim bIsEWFInstalled  : bIsEWFInstalled = false       'Boolean for EWF installed.
Dim bIsFBWFInstalled : bIsFBWFInstalled = false      'Boolean for FBWF installed.
Dim strCommand : strCommand = null                   'The string holding the command-line argument.

Set gWshShell = WScript.CreateObject("WScript.Shell")       '# Create the Shell Object.

CheckWindowsEmbedded              '# Check to ensure this script is being run on Windows Embedded.

' Check whether any command-line argument is passed, and process.
If WScript.Arguments.Count = 1 Then
    strCommand = UCase(WScript.Arguments.Item(0))
    Select Case strCommand
        Case "DISABLE"
            CheckWhichWF
            DisableWF
        Case "ENABLE"
            CheckWhichWF
            EnableWF
        Case Else
            WScript.Quit (0)
    End Select

Else
    WScript.Echo "Invalid Command Line: Missing Action Parameter"
    WScript.Echo "USAGE:"
    WScript.Echo "EWF-FBWF.vbs [Disable|Enable]"
    WScript.Quit (0)
End If


WScript.Quit (0)


'--------------------------------------------------------------------------------------------
'   CheckWindowsEmbedded
'
'   Checks to ensure this script is being run on Windows Embedded and, if not, exits.
'     If there was no error in finding the key, read the string values from the key.
'     If the "EmbeddedNT" string is found, this is XPe.
'     In all other cases, bIsXPe is left as false, which causes an exit.
'--------------------------------------------------------------------------------------------
Sub CheckWindowsEmbedded()
    Dim arrValues, bIsXPe
    bIsXPe = FALSE
    
    arrValues = gWshShell.RegRead(XPE_REG_KEY)
    
    If Err.Number = 0 then
       For Each strValue in arrValues
            if strValue = "EmbeddedNT" then
                bIsXPe = True   
            end if 
       Next
    End If         
    Err.Clear
   
    if not bIsXPe then
        WScript.Quit (0)
    end if
End Sub


'--------------------------------------------------------------------------------------------
'  CheckWhichWF
'
'  Determines which write filter (EWF or FBWF) is currently in use on this system and sets
'  a variable for use in other sections of this script. Because both EWF and FBWF can be on
'  a system (but not both controlling the protection of that system), simply testing for
'  the existence of the executable is not sufficient. Without using a separate C++ program
'  that accesses the EWF or FBWF API, the only way to test for which one is protecting the
'  drive is to use the output of the program at the command line to see whether it is active
'  and which drive is being protected.
'
'--------------------------------------------------------------------------------------------
Sub CheckWhichWF
    Dim oFSO, strFile, strPath, wsx
    Dim output, strLine
    Dim Status
    Set oFSO = CreateObject("Scripting.FileSystemObject") 
        
    strPath = gWshShell.ExpandEnvironmentStrings("%SystemRoot%")
    If IsEmpty(strPath) Then
        WScript.Quit (1)
    Else
        '============================================
        '                    EWF
        '============================================
        'Check to see whether EWFMGR.EXE is on the system.
        strFile = strPath + "\system32\EWFMGR.EXE"
        If oFSO.FileExists(strFile) Then
            'Run the EWF Manager to see whether the drive is actually protected.
            set wsx = gWshShell.Exec("%comspec% /c " & strFile & " -all")
            Do
                Status = wsx.Status
              
                ' Parsing the output of the command to see whether the EWF is enabled 
                ' and which drive is being protected (if any). Typical output 
                ' of this command looks like this:
                '
                '   Protected Volume Configuration
                '     Type            RAM
                '     State           DISABLED
                '     Boot Command    ENABLE
                '       Param1        0
                '       Param2        0
                '     Persistent Data ""
                '     Volume ID       A7 FA CA 34 00 7E 00 00 00 00 00 00 00 00 00 00
                '     Device Name     "\Device\HarddiskVolume1" [C:]
                '     Max Levels      1
                '     Clump Size      512
                '     Current Level   N/A
                '
                output = split(wsx.Stdout.ReadAll(), vbNewLine)
                For Each strLine in output
                    if InStr(strLine, "State") then
                        ' If the output from the command generated text like the above, 
                        ' EWF must be installed. Now check whether it's enabled or disabled.
                        bIsEWFInstalled = True                    
                        if InStr(strLine, "DISABLED") then
                            bIsWFEnabled = false
                        elseif InStr(strLine, "ENABLED") then
                            bIsWfEnabled = true
                        end if
                    End If
                    
                    ' Check which drive is being protected, and get the drive letter
                    ' because the drive letter is required in the command line.
                    if (bIsEWFInstalled) AND (InStr(strLine, "Device Name")) Then
                        strProtectedDrive = left(right(strLine, 3), 2)
                        'Set the default commands to be used elsewhere in this script.
                        strEnableCommand = strFile & " " & strProtectedDrive & " -enable"
                        strDisableCommand = strFile & " " & strProtectedDrive & " -disable"
                    End If    
                Next

                If Status <> 0 Then Exit Do
                WScript.Sleep 10

            Loop
        End if
        
        '============================================
        '                    FBWF
        '============================================
        'If EWF is enabled, FBWF cannot be enabled, so if EWF enabled, skip FBWF.
        If (Not bIsWFEnabled) Then
            Dim bCurrentState : bCurrentState = false
            Dim intLoopNum : intLoopNum = 0

            'Check to see whether FBWFMGR.EXE is on the system.
            strFile = strPath + "\system32\FBWFMGR.EXE"
            If oFSO.FileExists(strFile) Then
                'Run the FBWF Manager to see whether the drive is actually protected.
                set wsx = gWshShell.Exec("%comspec% /c " & strFile & " /displayconfig")
                Do
                    Status = wsx.Status
                    
                    ' Parsing the output of the command to see whether the EWF is enabled 
                    ' and which drive is being protected (if any). Typical output 
                    ' of this command looks like this:
                    '
                    '   File-based write filter configuration for the current session:
                    '     filter state: disabled.
                    '
                    '   File-based write filter configuration for the next session:
                    '     filter state: enabled.
                    '     overlay cache data compression state: disabled.
                    '     overlay cache threshold: 64 MB.
                    '     overlay cache pre-allocation: enabled.
                    '     protected volume list:
                    '       \Device\HarddiskVolume1
                    '     write-through list of each protected volume:
                    '       \Device\HarddiskVolume1: (none)
                    '
                    output = split(wsx.Stdout.ReadAll(), vbNewLine)
                    For Each strLine in output
                        if InStr(strLine, "current session:") then
                            ' If the output from the command generated text like the above, 
                            ' EWF must be installed. Now check whether it's enabled or disabled.
                            bIsFBWFInstalled = True
                            
                           ' Gathering data from the current session (not the next session).
                           bCurrentState = true
                        elseif InStr(strLine, "next session:") then
                            bCurrentState = false
                            bNextState = true
                        end if
                    
                        ' If the Current State / filter state = enabled, FBWF is enabled.
                        if (bCurrentState) AND (InStr(strLine, "filter state:")) then
                            if (InStr(strLine, "enabled")) then
                                bIsWFEnabled = true
                            else
                                bIsWFEnabled = false
                            end if
                            Exit For
                        end if
                    Next
                    If Status <> 0 Then Exit Do
                    WScript.Sleep 10
                Loop
                'Set the default commands to be used elsewhere in this script.
                if bIsFBWFInstalled then
                    strEnableCommand = strFile & " /enable"
                    strDisableCommand = strFile & " /disable"
                End if
            End if          
        End if
    End If
End Sub


'--------------------------------------------------------------------------------------------
'   DisableWF
'
'   This sub is used to disable the write filter on the drive (EWF or FBWF) so that updates
'   can be written to the storage device.
'
'   If the drive is already disabled, this subroutine does nothing but just return. Otherwise,
'   the function will disable the EWF and reboot the machine.
'
'--------------------------------------------------------------------------------------------
Sub DisableWF
        Dim oExec
    
        'If the write filter is enabled, disable it.
        if bIsWFEnabled then
            Set oExec = gWshShell.Exec(strDisableCommand)
            'Wait for the previous command to complete.
            Do While oExec.Status = 0
                WScript.Sleep 100
            Loop
        
            'Reboot the machine to complete the operation.
            RebootEx 0
    End If
End Sub



'--------------------------------------------------------------------------------------------
'   EnableWF
'
'   This sub is used to enable the write filter on the drive (EWF or FBWF).
'
'   The function will enable the EWF and reboot the machine in two minutes so that task sequence 
'   will have time to clean up itself.
'
'--------------------------------------------------------------------------------------------
Sub EnableWF
        Dim oExec
    
        ' If the write filter is installed, enable it.
        if (bIsEWFInstalled OR bIsFBWFInstalled) then
            Set oExec = gWshShell.Exec(strEnableCommand)
            ' Wait for the previous command to complete.
            Do While oExec.Status = 0
            
                WScript.Sleep 100
            Loop
        
            'Reboot the machine to complete the operation.
            RebootEx 120
    End If
End Sub


'--------------------------------------------------------------------------------------------
'    RebootEx
' 
'   This sub reboots the system.
'--------------------------------------------------------------------------------------------
Sub RebootEx(intSeconds)

       Dim strRebootCommandLine

       strRebootCommandLine = "shutdown.exe -r -t " & intSeconds
       
      Set oExec = gWshShell.Exec(strRebootCommandLine)
      
      Do While oExec.Status = 0
            WScript.Sleep 100
      Loop
End Sub