Using the Enhanced Write Filter (EWF) status utility
The EWF status utility creates an icon in the notification area at the far right of the taskbar that shows
the status of the EWF. You can right-click on the icon to display and execute the available options.
The EWF Status icon displays the following states:
●
Red lock: EWF is disabled.
●
Green lock: EWF is enabled.
●
Yellow lock: EWF state will change on next boot.
If you are logged on as an administrator, you can change the status of EWF by right-clicking the icon
and selecting the desired EWF state.
NOTE:
Because the ewfmgr.exe utility and the EWF status utility execute separate code, status
changes by ewfmgr.exe are not automatically reflected by the EWF status icon.
If you modify the EWF using the command line, you must right-click the icon (you can then click anywhere
on the screen to close the context menu) to refresh the status icon display. The status icon display is
refreshed automatically when you make modifications through the EWF utility. The EWF utility always
reflects the current status.
Using the Enhanced Write Filter (EWF) status utility
17
