UWF lockdown

Set-UwfLockdown.ps1 write-protects a Windows 11 kiosk/shared PC with the Unified Write Filter. Every fixed volume is protected except one data drive (D: by default), so anything a user changes outside that drive is discarded on reboot.

Requires Windows 11 Enterprise, Education or IoT Enterprise — Home and Pro do not include UWF. Run from an elevated PowerShell session.

Execution policy

PowerShell blocks .ps1 files by default. Run it with a per-process bypass:

powershell -ExecutionPolicy Bypass -File .\Set-UwfLockdown.ps1

If the script was copied from a share or downloaded, also Unblock-File .\Set-UwfLockdown.ps1.

For a fleet, set Set-ExecutionPolicy -Scope LocalMachine RemoteSigned (or push it by GPO) before enabling UWF — afterwards the change lands in the overlay and is lost on reboot.

Usage

# First run installs the optional feature and asks for a reboot
.\Set-UwfLockdown.ps1

# Second run configures and enables the filter; reboot again to activate
.\Set-UwfLockdown.ps1 -DataDrive D: -OverlaySizeMB 2048

# Preview without changing anything
.\Set-UwfLockdown.ps1 -DryRun

# Check the current configuration
.\Set-UwfLockdown.ps1 -Action Status

# Maintenance: disable, reboot, patch, re-apply
.\Set-UwfLockdown.ps1 -Action Disable

# Patch: arm servicing mode and reboot into it
.\Set-UwfLockdown.ps1 -Action Servicing

Windows Update

UWF does not exempt Windows Update. Its writes go to the overlay like everything else and vanish on reboot, so a protected machine never actually stays patched — and the download fills the overlay every single time. That has always been the behavior; UWF servicing mode is the supported fix, not a bug that got patched out.

.\Set-UwfLockdown.ps1 -Action Servicing

The machine reboots, signs into the auto-created UWF-Servicing account, installs updates (rebooting as often as needed), then re-enables protection by itself. Only critical, security and driver updates are supported — feature updates are not. Do not create a local account named UWF-Servicing; it collides with the one UWF makes.

Notes

• The overlay holds all writes until reboot. When it fills, the machine misbehaves until it restarts — size it for a full day of use.
• Free space passthrough is turned on for disk overlays, so the overlay can spill into unused space on the system volume past the reserved size rather than wedging the machine the moment it hits the cap.
• Fast startup is turned off during setup. UWF does not support it — with it on, a shutdown does not clear the overlay and the machine comes back dirty.
• Changing the overlay type needs the filter off in the current session. On a machine that is already protected, the script disables the filter and asks for a reboot; run it again after that to finish.
• Defaults to a 1 GB disk overlay. With passthrough on, that number is only the reservation — the overlay grows into free space on the system volume beyond it, so the real ceiling is how empty C: is. -OverlayType RAM is faster but has no passthrough and comes straight out of physical memory, so size it much larger if you switch.
• Use -FileExclusion for paths on protected volumes that must persist, e.g. -FileExclusion 'C:\ProgramData\LineOfBusinessApp\state'.
• Redirect user profile data (Documents, Desktop, Downloads) to the data drive, or users will lose it on every reboot.
• A persistent overlay (uwfmgr overlay set-persistent on) would survive reboots, but that defeats the point here, so the script does not use it.

References

• Unified Write Filter
• uwfmgr.exe reference
• Apply Windows updates to UWF-protected devices