EWF and PendingFileRenameOperations

[Jordi]

I've noticed that the registry key PendingFileRenameOperations to rename
files on reboot is ignored when EWF is enable. The installer works correctly
when EWF is disabled or commited after the install.

Is that normal?

(Of course I'm not installing into the protected volume.)

 

[Srikanth Kamath [MSFT]]

Here's how PendingFileRenameOperations works - when the installer tries to
rename a file in use , the system adds an {oldname, newname} entry to
HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\
PendingFileRenameOperations and the actual renaming occurs upon the next
restart. Any change to the registry would persist only if this hive maps to
an unprotected partition.

To summarize - PendingFileRenameOperations will work only if the hive maps
to a partition which is not protected by EWF

Thanks
Srikanth

 

[Srikanth Kamath [MSFT]]

Here's a brief description of how PendingFileRenameOperations works
(http://technet.microsoft.com/en-us/library/cc960241.aspx)

To make this work with EWF - you need to find the partition into which the
registry hive maps and unprotect it to ensure writes to this registry key
persisit across reboot and renaming succeeds.

Thanks
Srikanth

 

[Srikanth Kamath [MSFT]]

FYI - %SystemRoot%\System32\Config\System file backs HKLM\System hive. So you
would need to unprotect your OS partition.

Thanks
Srikanth