Okay, so I have an interesting issue and finding information about Windows Thin PC (WinTPC) on the web is sparse. Hope this is something someone
has tried.
- Have a Win TPC x86 SP1 built on a VM. Configure as needed with patches and use SCCM 2012 R2 Capture media to capture/sysprep the WIM file. Image has only 1 partition. For simplicity, UAC is disabled
in the image using local policies.
- Import the WIM in ConfigMgr 2012 R2, insert into a task sequence. Install needed software part of task sequence.
- We want to enable file based write filter on this image. WinTPC comes FBWFMGR pre-installed on %WINDIR%\System32. We also want to exclude some files/folders/registries so that changes are retained.
We run the following commands on the task sequence -
=============fbwfmgr /enablefbwfmgr /addvolume c:fbwfmgr /addexclusion c: "\Program Files\McAfee"fbwfmgr /addexclusion c: "\Windows\ccm"fbwfmgr /addexclusion c: "\Windows\ccmsetup"fbwfmgr /addexclusion c: "\Windows\ccmcache"fbwfmgr /addexclusion c: "\Windows\SMSCFG.ini"fbwfmgr /addexclusion c: "\Windows\system32\wbem"fbwfmgr /addexclusion c: "\Windows\system32\config" =============
This is run in a batch file. =============Windows Registry Editor Version 5.00[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RegFilter\Parameters\MonitoredKeys\3]"ClassKey"="HKLM" "FileNameForSaving"="SysAid.RGF" "RelativeKeyName"="Software\\Ilient"[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RegFilter\Parameters\MonitoredKeys\4]"ClassKey"="HKLM" "FileNameForSaving"="McAfee.RGF" "RelativeKeyName"="Software\\McAfee"[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RegFilter\Parameters\MonitoredKeys\5]"ClassKey"="HKLM" "FileNameForSaving"="Citrix.RGF" "RelativeKeyName"="Software\\Citrix"[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RegFilter\Parameters\MonitoredKeys\6]"ClassKey"="HKLM" "FileNameForSaving"="BITS.RGF" "RelativeKeyName"="Software\\Microsoft\\Windows\\CurrentVersion\\BITS"[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RegFilter\Parameters\MonitoredKeys\7]"ClassKey"="HKLM" "FileNameForSaving"="SCCMClient.RGF" "RelativeKeyName"="Software\\Microsoft\\CCM" ============= This is run using reg.exe run through a reg file. =============
This enables the FBWF write filter. This also sets volume C: be protected and folders/files
excluded. The registry file also sets exclusions for particular software and HIVE for exclusions. FBWF automatically excludes machinepassword & system activation registry keys, which does get set (verified in registry @ this hive) –
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RegFilter\Parameters\MonitoredKeys\_MachineAccount
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RegFilter\Parameters\MonitoredKeys\_MSLicensing]
Finally, reboot the system (thin client) and all should be complete.
But this process does not seem to be working (for me, yet) and I was hoping if someone had experience provisioning a thin PC (WinTPC or Windows Embedded,
built through SCCM OSD and Write Filter provisioned).
For the first login, I do notice the FBWF is enabled and exclusions set. I start getting prompts “Open File – Security Warning” for ie4uinit.exe,
regsvr32.exe, WinMail.exe, unregmp2.exe, rundll32.exe, sidebar.exe and similar. Example screenshot attached. Windows is activated in this logon.![]()
Finally after all the prompts and a very slow logon, I get in, try to create a file on the desktop (to test whether it gets deleted or retained)
and reboot. On the next logon, I get weird errors including windows activation, the same series of prompts as in first logon, and logged on with temporary profile. This continues on every other attempted logon. Do note, that temporary file created is gone
(so FBWF is working).![]()
I need to fix these errors or figure out what I may be doing wrong. How do someone typically capture WIM for Win TPC? Is the SCCM Capture method
not supported? Should I be using autounattend? If I am following things properly, does FBWF require any additional partition created or assigned?
Your ideas and thoughts or a working experience is appreciated.
Reference websites –
NOTE: For some who may not have worked with Windows TPC Standard, is a stripped down version of Windows 7 and very similar to
Windows Embedded Standard. So any steps that might work for Embedded will also work for TPC.