Use Write Filter WMI Providers (Standard 7 SP1)

7/8/2014

This topic describes the object model of the Enhanced Write Filter (EWF) and File-Based Write Filter (FBWF) Providers and their role in the overall Windows Management Instrumentation (WMI) environment. This topic assumes prior knowledge of EWF, FBWF, and WMI.

Overview

The EWF and FBWF Providers map the functionality of the Write Filter APIs to an object-oriented model to better fit into the WMI environment and support access through WMI objects. They consist of singleton classes and multiple type instances, with the instances created when enumerating the type. All classes are registered in the "\\root\Microsoft\WriteFilters" namespace.

The following illustration is a high level overview of the WMI architecture and how the Write Filter Providers fit within it.

The following illustration provides more detail on how the providers are hosted within the WMI hosting process.

The client application connects to a WMI namespace and requests one of the types registered by the EWF Provider or the FBWF Provider. This is done by enumerating all types, or by retrieving a specific instance. The WMI service then invokes the WMI hosting process to call the provider library that is needed to perform the request and call the native API.

Access to EWF and FBWF Providers by Administrator and Standard User Accounts

One of the benefits to the Write Filter Providers is that they enable users with limited permissions to access the read-only functionality of the Write Filter APIs. A user account with administrator permissions is still required to modify write filter configurations or to make calls to the Write Filter Providers on remote machines.

Enhanced Write Filter WMI Provider

The EWF Provider contains the following set of classes:

• Ewf
  A singleton class used to execute methods on all volumes in the protected volume list. For example, this class can be used to enable the overlay on all the volumes or to commit data from each overlay to the disk.

• EwfVolumeConfiguration
  Instances of this class can be used to access the settings of each volume in the protected volume list.

• EwfVolume
  Instances of this class can be used to change the configuration of a protected volume.

• EwfOverlayStoreConfiguration
  A singleton class used to access information about the overlay store configuration.

• EwfLevelDescriptor
  Instances of this class can be used to access information about the overlay levels of protected volumes.

The following illustration shows the EWF Provider classes and their relationships.

File-Based Write Filter WMI Provider

The FBWF Provider contains the following set of classes:

• Fbwf
  A singleton class used for general FBWF operations, such as disabling and enabling the filter, setting the cache threshold, and adding or removing paths in the protected file list.

• FbwfVolumeConfiguration
  Instances of this class can be used to access configuration settings for each protected volume.

• FbwfPathExclusionListEntry
  Instances of this class can be used to access the information about items in the exclusion list of a protected volume.

• FbwfCacheDetail
  Instances of this class can be used to store information about files and directories in the cache that are modified.

• FbwfMemoryConfiguration
  A singleton class used to access information about memory usage and cache threshold. The class can also be used to modify memory-related settings.

• FbwfFileSystemInformation
  Instances of this class can be used to access information about file system volumes.

The following illustration shows the FBWF Provider classes and their relationships.

See Also

Other Resources

Write Filter WMI Providers Technical Reference