Installing & Using CMS 7.1 on Windows Embedded Standard 7 (WES7) with the File Based Write Filter (FBWF)

Article:TECH190554  |  Created: 2012-06-07  |  Updated: 2013-07-15  |  Article URL http://www.symantec.com/docs/TECH190554
Article Type
Technical Solution


Environment

Issue



If you have Windows Embedded Standard 7 with the write filter enabled all your changes (including CMS agent policies) are discarded when the thin client is rebooted. How can the CMS 7.1 agent(s) be installed on Windows Embedded Standard 7 with the File Based Writer Filter (FBWF) enabled?


Environment



  • Windows Embedded Standard 7 x86 (WES7)
  • File Based Write Filter (FBWF)
  • Symantec Altiris Client Management Suite 7.1

The procedures in this article do not work with the Enhanced Write Filter (EWF) as the EWF does not have a mechanism for exclusions. EWF requires the use of Microsoft API´s which the CMS agents do not use.

Note: Support for Windows Embedded Standard 7 applies to the Symantec Management Agent 7.1, Inventory Solution 7.1, Software Management Solution 7.1, Patch Management Solution 7.1, pcAnywhere Solution 7.1 and Workspace Virtualization 6, subject to the below considerations for EWF. Currently, Deployment Solution 6.9 is required for Windows Embedded imaging and scripted installation support.


Cause



The Enhanced Writer Filter (EWF) or File Based Write Filter (FBWF) are components of Windows XP Embedded and Windows Embedded Standard 7 which filters writes to another medium (memory)  instead of being physically written to the volume itself. EWF or FBWF allows the writes to be discarded or committed to the physical volume later.

You can compare the write filter with a layer of plastic foil which is wrapped around a particular volume. All changes will be caught by the foil and every time a reboot occurs these changes are discarded (unless you tell the write filter to commit these changes). The difference between the EWF and the FBWF is that for the FBWF you can puncture holes on particular places in the foil so that changes for these locations are written to the volume and saved automatically (without committing these changes). The EWF follows a all or nothing approach.

To allow the CMS agent(s) to write the changes in the file system and registry it makes when running (like policies, guids, etc) the correct exclusions need to be applied to the FBWF.
 


Solution



  • Install the WES 7 operating system with the Thin Client template. This template has all the features required by the CMS agents.
  • Ensure that the FBWF is off during installation of the agent()s. After installation you can enable the FBWF, add a volume (if you not have already done so) and reboot to activate the FBWF.
  • Note that the exclusions specified are only valid for the 32-bit variant of WES7.
  • If you have user account control active then run the FBWF command lines from an elevated command prompt (run as administrator).

FBWF command lines

  • Enable FBWF: fbwfmgr /enable
  • Add a volume: fbwfmgr /addvolume <volume>, for example: fbwfmgr /addvolume c:
  • Add a file/directory exclusion: fbwfmgr /addexclusion <volume> <exclusion>, for example: fbwfmgr /addexclusion c: "\Program Files\Altiris" 
  • Show the configuration & status: fbwfmgr /displayconfig
  • Disable the FBWF: fbwfmgr /disable

Warning: Incorrect use of the Windows registry editor may prevent the operating system from functioning properly. Great care should be taken when making changes to a Windows registry. Registry modifications should only be carried-out by persons experienced in the use of the registry editor application. It is recommended that a complete backup of the Windows registry be made prior to making any registry changes.

Warning: Incorrect changes in the database may prevent the product from functioning properly. Great care should be taken when making changes to the database. Database modifications should only be carried-out by persons experienced in the use of the database editor application. It is recommended that a complete backup of the database be made prior to making any database changes.


Symantec Management Agent

  • Install the Symantec Management Agent (manual installation or push installation)
  • Add exlusions for the following directories: C:\Program Files\Common Files\Altiris, C:\Program Files\Altiris\Altiris Agent, C:\ProgramData\Symantec\Symantec Agent & C:\Users\All Users\Symantec\Symantec Agent
  • Add exclusions for the following registry keys:HKLM\SOFTWARE\Altiris\Altiris Agent\Servers\, HKLM\SOFTWARE\Altiris\Altiris Agent, HKLM\SOFTWARE\Altiris\Communications & HKLM\SOFTWARE\Altiris\eXpress\NS Client or add a exclusion for the complete HKLM\SOFTWARE\Altiris key
  • Import the changed Windows Embedded filter (see Windows Embedded.xml attachment) 
  • Run the attached SQL Query

Note: The exclusions for all sub agents are on top of the exclusions for the Symantec Management Agent

Under default conditions the agent must have access to 500MB of disk space to install. This setting can be changed via the following command line:
Reg add "HKLM\SOFTWARE\Altiris\Communications\Package Delivery" /v "Min Disk Free Space (MBytes)" /t REG_DWORD /d 400 /f

Where 400 represents the number of megabytes. More info in the following knowledge base articles:

Other limitations that may apply are:

  • Software will not install properly when choosing the option to run from server
  • When Deploying Software that has a Policy set to only install when a user is logged off, the software may install to machines with logged on users.
  • When running applications configured to not run in silent mode and are specified to run minimized, the applications will run maximized.
  • If the default software update policy is configured to have the agent restart at the end of the software update cycle and patch fails to install the client will restart after the failure.

Patch Management
The agent installation policy recognizes WES7 so to install just enable the policy. WES7 is also in the PMimport file, just make sure that you selected the OS in the list of vendors & products. If you have chosen to make registry exclusions on specific keys then you need to add an exclusion for HKLM\SOFTWARE\Altiris\Altiris Agent\Patch Management.

When you are deploying patches you are going to make (a lot of) changes to the OS. This means that you want to turn the write filter off before the agent is going to start it´s patch cycle. One way of doing this is setting the patch installation schedule to a specific time, for instance 22.00h and have job run at 21.55h to disable the write filter & reboot the client.

Software Management
The agent installation recognizes WES7 so there is no need to make any changes for the deployment of the software management plugin. You just have to enable the policy to get it installed on the thin cient. There are also no additonal exclusions needed. Remember that when you are going to install software you need to disable the write filter before the installation starts. One way of doing  this is by making a job which consists of the following tasks:
1. Disable the write filter
2. Reboot
3. Install your software
4. Reboot if necessary for a correct installation of the software
5. Add exclusions if necessary for the installed software
6. Enable the write filter
7. Reboot

Inventory Solution
Import the attached Windows Computers without Inventory Plug-in.xml so that the inventory agent installation policy recognizes WES7. After installation of the plugin the directory C:\Program Files\Altiris\Inventory need to be added to the exclusion list. If you are using exclusions for specific registry keys you also need to add HKLM\SOFTWARE\Altiris\eXpress\Inventory to exclusion list.

Application Metering Solution
Import the attached Windows Computers without Application Metering Plug-in.xml so that the inventory agent installation policy recognizes WES7. If you are using exclusions for specific registry keys you also need to add HKLM\SOFTWARE\Altiris\Application Metering to exclusion list. Please note that the Application Metering plug-in only will install if the Inventory Solution plug-in is installed.

pcAnywhere Solution
The agent installation policy for the pcAnywhere plugin recognizes WES7. After the installation is finished you need to exclusions for the following directories and registry keys:
HKLM\SOFTWARE\Policies\Symantec
HKLM\SOFTWARE\Symantec\InstalledApps
HKLM\SOFTWARE\Symantec\pcAnywhere
C:\Program Files\Common Files\Symantec Shared
C:\Program Files\Symantec\pcAnywhere
C:\ProgramData\Symantec\pcAnywhere
C:\ProgramData\Symantec\pcASolutionLog
C:\Users\All Users\Symantec\pcAnywhere
C:\Users\All Users\Symantec\pcASolutionLog

Symantec Workspace Virtualization
The agent installation policy for the Symantec Workspace Virtualization agent recognizes WES7. After the installation add the following exclusions:
HKLM\SOFTWARE\fslrdr
HKLM\SYSTEM\CurrentControlSet\services\FSLX
C:\Program Files\Symantec\Workspace Virtualization
C:\ProgramData\Symantec\SEV
C:\Users\All Users\Symantec\SEV
C:\fslrdr

Example FBWF batch file
To add all necesarry exclusions and enable the write filter you can create a batch file similar to this:
REM Enable the write filter
fbwfmgr /enable

REM Add the c volume to the overlay
fbwfmgr /addvolume c:

REM Add the exclusions for the CMS agents
fbwfmgr /addexclusion c: "\Program Files\Common Files\Altiris"
fbwfmgr /addexclusion c: "\Program Files\Altiris\Altiris Agent"
fbwfmgr /addexclusion c: "\ProgramData\Symantec\Symantec Agent"
fbwfmgr /addexclusion c: "\Users\All Users\Symantec\Symantec Agent"
fbwfmgr /addexclusion c: "\Program Files\Altiris\Inventory"
fbwfmgr /addexclusion c: "\Program Files\Common Files\Symantec Shared"
fbwfmgr /addexclusion c: "\Program Files\Symantec\pcAnywhere"
fbwfmgr /addexclusion c: "\ProgramData\Symantec\pcAnywhere"
fbwfmgr /addexclusion c: "\ProgramData\Symantec\pcASolutionLog"
fbwfmgr /addexclusion c: "\Users\All Users\Symantec\pcAnywhere"
fbwfmgr /addexclusion c: "\Users\All Users\Symantec\pcASolutionLog"
fbwfmgr /addexclusion c: "\Program Files\Symantec\Workspace Virtualization"
fbwfmgr /addexclusion c: "\ProgramData\Symantec\SEV"
fbwfmgr /addexclusion c: "\Users\All Users\Symantec\SEV"
fbwfmgr /addexclusion c: "\fslrdr"

REM Add the registry exclusions
reg add "HKLM\SYSTEM\CurrentControlSet\services\RegFilter\Parameters\MonitoredKeys\Altiris" /v ClassKey /t REG_SZ /d HKLM /f
reg add "HKLM\SYSTEM\CurrentControlSet\services\RegFilter\Parameters\MonitoredKeys\Altiris" /v FileNameForSaving /t REG_SZ /d Altiris.RGF /f
reg add "HKLM\SYSTEM\CurrentControlSet\services\RegFilter\Parameters\MonitoredKeys\Altiris" /v RelativeKeyName /t REG_SZ /d "Software\Altiris" /f

reg add "HKLM\SYSTEM\CurrentControlSet\services\RegFilter\Parameters\MonitoredKeys\Symantec" /v ClassKey /t REG_SZ /d HKLM /f
reg add "HKLM\SYSTEM\CurrentControlSet\services\RegFilter\Parameters\MonitoredKeys\Symantec" /v FileNameForSaving /t REG_SZ /d Symantec.RGF /f
reg add "HKLM\SYSTEM\CurrentControlSet\services\RegFilter\Parameters\MonitoredKeys\Symantec" /v RelativeKeyName /t REG_SZ /d "Software\Symantec" /f

reg add "HKLM\SYSTEM\CurrentControlSet\services\RegFilter\Parameters\MonitoredKeys\Symc_Policies" /v ClassKey /t REG_SZ /d HKLM /f
reg add "HKLM\SYSTEM\CurrentControlSet\services\RegFilter\Parameters\MonitoredKeys\Symc_Policies" /v FileNameForSaving /t REG_SZ /d Symc_Policies.RGF /f
reg add "HKLM\SYSTEM\CurrentControlSet\services\RegFilter\Parameters\MonitoredKeys\Symc_Policies" /v RelativeKeyName /t REG_SZ /d "Software\Policies\Symantec" /f

reg add "HKLM\SYSTEM\CurrentControlSet\services\RegFilter\Parameters\MonitoredKeys\SWV_RDR" /v ClassKey /t REG_SZ /d HKLM /f
reg add "HKLM\SYSTEM\CurrentControlSet\services\RegFilter\Parameters\MonitoredKeys\SWV_RDR" /v FileNameForSaving /t REG_SZ /d SWV_RDR.RGF /f
reg add "HKLM\SYSTEM\CurrentControlSet\services\RegFilter\Parameters\MonitoredKeys\SWV_RDR" /v RelativeKeyName /t REG_SZ /d "Software\fslrdr" /f

reg add "HKLM\SYSTEM\CurrentControlSet\services\RegFilter\Parameters\MonitoredKeys\SWV_SVC" /v ClassKey /t REG_SZ /d HKLM /f
reg add "HKLM\SYSTEM\CurrentControlSet\services\RegFilter\Parameters\MonitoredKeys\SWV_SVC" /v FileNameForSaving /t REG_SZ /d SWV_SVC.RGF /f
reg add "HKLM\SYSTEM\CurrentControlSet\services\RegFilter\Parameters\MonitoredKeys\SWV_SVC" /v RelativeKeyName /t REG_SZ /d "SYSTEM\CurrentControlSet\services\FSLX" /f

REM Change the free space registry key
Reg add "HKLM\SOFTWARE\Altiris\Communications\Package Delivery" /v "Min Disk Free Space (MBytes)" /t REG_DWORD /d 200 /f

 

Reg add "HKLM\SOFTWARE\Altiris\Communications\Package Delivery" /v "Min Disk Free Space (MBytes)" /t REG_DWORD /d 400 /f

 


Attachments

Changed filter to support WES7 for Inventory Solution Plug-in
Windows Computers without Inventory Plug-in.xml (7 kBytes)
Changed filter to include WES7 in the Windows Embedded targeted agent settings
Windows Embedded.xml (6 kBytes)


Changed SQL function to remove WES7 from the unsupported windows filter. Run this SQL against your Symantec CMDB.
Changed SQL function.txt (929 Bytes)
Changed filter to support WES7 for Application Metering Plug-in
Windows Computers without Application Metering Plug-in.xml (9 kBytes)


Article URL http://www.symantec.com/docs/TECH190554


Terms of use for this information are found in Legal Notices