UWF Monitor

UWF Monitor is a lightweight graphical tool for the Microsoft Unified Write Filter (UWF) on Windows. Instead of memorizing uwfmgr commands, you get a clear window that shows whether protection is on, which volumes are protected, how much overlay space is in use, and what is on the exclusion list — and lets you change those settings directly.

It is built for administrators and everyday users of public, kiosk, classroom, and embedded machines who need to keep an eye on UWF without having to touch the command line.

• Status at a glance: protection on/off, protected volumes, overlay usage, and exclusions — all in one view.
• No command line needed: do what uwfmgr does, through a simple interface.
• Manage protection safely: toggle protection and edit exclusions, with reboot reminders so changes apply correctly.

UWF (Unified Write Filter) is an optional protection feature built into Windows. When it is turned on, every write to a protected drive (installing apps, changing settings, creating files, or even damage from malware) is never actually committed to the disk. Instead, each write is intercepted and redirected to a temporary area called the overlay (a virtual overlay).

This overlay is temporary and is cleared on every restart or when a guest user logs off, so the drive returns to its clean, original state. UWF is the successor to the older EWF (Enhanced Write Filter) and FBWF (File-Based Write Filter). It can protect hard disks, SSDs, internal USB devices, and external SATA devices, and it supports both MBR and GPT disks.

UWF was originally available only in Embedded/IoT editions, but its availability has since been expanded. The supported editions include:

• Windows 10/11 Enterprise (including LTSC)
• Windows Education
• Windows IoT Enterprise

Whenever you want a PC to return to a fixed, clean state after every restart, UWF is a good fit. Common scenarios:

• Shared/public computers: classrooms, libraries, hotel lobbies, and other machines used by many different people, without worrying about unwanted software installs or setting changes.
• Demo and self-service terminals: kiosks, demo stands, and digital signage that reset every time they reboot.
• Workstations that must keep a fixed environment: thin clients and single-purpose operator stations.
• Lower maintenance overhead: instead of re-imaging or restoring machines one by one, let the system "reset on reboot."

There are two steps: first, "install the feature," then "enable it and specify the drive to protect."

Step 1: Install the UWF feature

1. Press Win + R, type optionalfeatures to open "Turn Windows features on or off."
2. Expand the Device Lockdown node.
3. Check Unified Write Filter, click OK, and wait for Windows to apply the changes before closing the window.

Step 2: Enable UWF and protect a drive

1. Open Command Prompt as an administrator.
2. Enable the filter and protect drive C:

uwfmgr filter enable
uwfmgr volume protect C:

3. Restart the computer for the changes to take effect.

You can check the current configuration at any time:

uwfmgr get-config

To disable protection (for example, to perform updates or maintenance), run the following command and then restart:

uwfmgr filter disable

Every storage block in an SSD has a limited write-endurance lifespan — the more frequently it is written, the faster it wears out. The way UWF works helps mitigate exactly this problem:

• Drastically reduces actual writes: with protection enabled, day-to-day writes such as temporary files, logs, caches, and updates are redirected to the overlay (usually in memory) rather than repeatedly written to the SSD, thereby reducing SSD wear.
• Extends SSD lifespan: write-sensitive flash memory (SSDs fall into this category), therefore lasts longer, which is especially valuable for public or signage machines that run around the clock.
• Improves stability and reliability: the system state remains fixed and does not gradually degrade due to accumulated miscellaneous writes.

UWF Monitor is a lightweight Windows utility that puts the Unified Write Filter (UWF) in front of you in a single, easy-to-read window. UWF is powerful, but out of the box it lives entirely on the command line: to find out whether protection is on, which drives are covered, or how full the overlay is, you have to run uwfmgr commands and read through raw text output. UWF Monitor turns all of that into a clear graphical view.

At a glance, UWF Monitor shows you the things that matter day to day: whether UWF is currently enabled, which volumes are protected, how much overlay space has been used, and which files or folders are on the exclusion list. Beyond monitoring, it also lets you manage those settings directly — adjusting protection, editing exclusions, and reviewing the UWF configuration — so you rarely need to open a command prompt again.

That makes it a natural fit for anyone running machines that must stay in a fixed, clean state: public and classroom PCs, kiosks and digital signage, thin clients, and embedded systems. Administrators get a fast health check of every protected machine, and everyday users get a simple way to confirm that protection is working — without memorizing a single command.

What the UWF Monitor does

• Monitor protection status: see at a glance whether UWF is on or off.
• View protected volumes: know exactly which drives UWF is guarding.
• Track overlay usage: watch how much of the overlay is in use before it fills up.
• Manage exclusions: review and edit the files and folders that bypass protection.
• Review configuration: check the current UWF settings without command-line lookups.

Once UWFMonitor.exe is running, it stays in the Windows notification area (system tray). You don't have to open any window — the icon's color tells you the UWF state at a glance, and a small vertical bar on the icon shows how full the overlay is.

What the icon color means

Icon	Color	Meaning
	Black	UWF is not installed, or its status could not be read.
	Gray	UWF is disabled.
	Green	UWF is enabled, overlay is RAM type, usage is normal.
	Blue	UWF is enabled, overlay is DISK type, usage is normal.
	Orange	UWF is enabled, and overlay usage has passed the Warning threshold.
	Red	UWF is enabled, and overlay usage has passed the Critical threshold.

Steady vs. blinking — a pending change

The icon also tells you whether a change is waiting for the next restart:

• Steady: the current state and the next-boot state are the same — nothing pending.
• Blinking: a change will take effect after you restart. The icon alternates between the current state (shown for 1.8 seconds) and a short preview of the next-boot state (shown for 0.2 seconds).

For example:

♦		: Disabled now, but enabled after reboot → Gray for 1.8 s, then a Green flash for 0.2 s.
♦		: Enabled now, but disabled after reboot → Green for 1.8 s, then a Gray flash for 0.2 s.

The overlay usage bar

Whenever UWF is enabled, a thin vertical bar is drawn along the right edge of the icon. It fills from the bottom up in 10 steps (about 10% each) according to how much of the overlay is in use, and it is colored to match the icon (green, blue, orange, or red). The bar is drawn inside the icon's right edge on purpose: the Windows tray uses a fixed square slot, so a wider, non-square icon would be squashed out of shape.

Hover over the icon to see the exact figure as Usage: X%. Values below 1% are shown as <1, and a full overlay is shown as 99+.