SCSP and DCS support for File-based write filter (FBWF) on Windows embedded.

Products

• Critical System Protection
• Data Center Security Server

Issue/Introduction

You wish to know if SCSP and DCS support the File-based write filter (FBWF) functionality on Windows embedded.

Resolution

Symantec Critical System Protection and Data Center Security products have not been officially tested with the FBWF function of Windows embedded. For that reason, FBWF is not officially supported for use with these products.

If FBWF is intended to be used as a security feature, it is advised to consider the alternative option of disabling FBWF and tuning CSP/DCS to secure the system appropriately.

However, if FBWF must be used, CSP/DCS would be expected to work with this module as long as the following conditions are met:

1. FBWF is not enabled until SCSP has been installed and configured and a policy has been applied.
2. FBWF is fully disabled before any changes are made to the active policy.
3. Logs are regularly uploaded to the SCSP Manager and prior to any reboot.

Symantec do not currently support this function and do not take any responsibility for any issues that may arise as a result of this information.

 

Applies To

File-based write filter (FBWF) is a Windows embedded function that redirects all changes made to a protected volume to an in-memory overlay. Any changes to the operating system, disk or registry are not retained after a reboot.