Microsoft's Embedded team acknowledges that "some developers may have run into issues when using Enhanced Write Filter (EWF) and Performance Monitoring on their Windows Embedded Standard 7 or Windows Embedded Standard 7 SP1 devices."
Consider the following scenario:
- You develop a Windows Embedded Standard 7 or Windows Embedded Standard 7 Service Pack 1 image for your device.
- You added "Performance Monitoring" package in your answer file using Image Configuration Editor.
- You added "Enhanced Write Filter with HORM" package in your answer file to protect the system (C:) volume.
- You deployed your image without executing "winsat prepop".
- You enabled EWF for the runtime image.
"In this scenario, you may see EWF RAM overlay is dramatically consumed when the system becomes idle. The cause for this is that when the system becomes idle, subsequent to the first boot, the WinSAT assessments will run if they weren't prepopulated. The assessments include the one for disk, and this consumes the overlay area if EWF is protecting the system drive because the assessment actually writes and reads a file to estimate the I/O performance," explained Microsoft.
The team offers three workarounds, for you to choose any one of the following options:
- Don't include WinEmb-Diagnostics-Performance (Diagnostics\Performance Monitoring) in your answer file.
This's a configuration level workaround. If the WinEmb-Diagnostics-Performance package is included, it'll register the "WinSAT" task under \Microsoft\Windows\Maintenance, and this'll start winsat.exe when the system becomes idle, leading to the consumption of the overlay. "schtasks.exe /query /tn "\Microsoft\Windows\Maintenance\WinSAT" /fo LIST /v" command may show you the details of the task.
- Execute "winsat prepop" before mass deployment.
This's a runtime level workaround, mainly targeting the image mastering phase. You'll find %IdentifierDerivedFromDate% %Component%.Assessment(Prepop).WinSAT.xml under %WINDIR%\performance\winsat\datastore after executing "winsat prepop". By using this method, task scheduler may start winsat.exe as registered, but winsat.exe mayn't run its full assessment. For more information on configuring WinSAT and pre-populating WinSAT assessments, read the TechNet article: "Configure Windows System Assessment Tests
- Execute "schtasks.exe /DELETE /TN "\Microsoft\Windows\Maintenance\WinSAT" /F" from an elevated command prompt.
This's the most straightforward way to prevent the system from running WinSAT. This can be executed at any time. Sysprep won't re-register the WinSAT task.