Installing Endpoint Protection 12.1.5 and earlier on Windows Embedded Standard 7 with File Based Write Filter (FBWF)

Products

• Endpoint Protection

Issue/Introduction

You want to install the Symantec Endpoint Protection (SEP) 12.1 (RU1 - RU5) client on a Windows 7 Embedded operating system with the File Based Write Filter (FBWF).

Cause

Without the correct exclusions, changes in the file system and registry (In the SEP client virus definition content for example) are wiped each reboot, causing the product, or its updates, to be reinstalled each reboot.  This is undesirable.

Resolution

Note: This article does not apply to 12.1.6. See Support for Windows Embedded for Symantec Endpoint Protection for details. For information on obtaining the newest release, see Download the latest version of Symantec Endpoint Protection.

---

1. Install Windows Embedded 7 OS that includes the following minimum features:
   • Internet Explorer 
   • TCP/IP Networking
   • COM Base
   • IP Security Services
   • NDIS & NDIS User-Mode I/O Driver
   • OLE Dialog Interfaces
   • FBA: Driver Signing (First Boot Agent)
      
2. Ensure that the File Based Write Filter is off and install the SEP client.
    
3. Restart the computer, and ensure the SEP client updates completely before proceeding to the next step.
    
4. Enable the File Based Write Filter.
    
5. Use FBWFMgr.exe to exclude the following Symantec directories:
   
   32-bit Windows 7
   • ProgramData\Symantec
   • Users\All Users\Symantec
   • Program files\Symantec
   • Program files\common files\Symantec Shared
    
   64 bit Windows 7
   • ProgramData\Symantec
   • Users\All Users\Symantec
   • Program files(x86)\Symantec
   • Program files(x86)\common files\Symantec
   • Program files\common files\Symantec Shared
6. Reboot.

Applies To

• Windows Embedded Standard 7 (WES7) with File Based Write Filter (FBWF)
• Symantec Endpoint Protection 12.1 RU1 - RU5

This procedure does not work with the Enhanced Write Filter (EWF) as EWF does not use exclusions.  EWF requires use of Microsoft APIs, which SEP does not use.