Siemens Industry Online Support
Siemens AG
Entry type: FAQ Entry ID: 40108744, Entry date: 09/14/2011

What should you watch out for when using the Enhanced Write Filters (EWF) on SIMATIC IPCs with Windows XP Embedded Standard?

  • Entry
  • Associated product(s)

You wish to install software or update software in a system protected by EWF mode (Windows XP Embedded Standard). If you disable the EWF for drive C:\ using the command "ewfmgr c: -commitanddisable" without rebooting the system beforehand, in rare cases it might happen that the system no longer starts after rebooting. The following message is displayed:

"Windows could not start because the following file is missing or corrupt:

The Windows Embedded Standard 2009 Installation on SIMATIC IPCs used a customized Registry entry. This Registry entry leads to the behavior described.

Install the attached Registry patch in order to be able to change the Registry entry. Installing the "REGFILTER_Patch.reg" Registry patch changes the Windows Registry.

Proceed as follows to install in a system protected by EWF Mode.


No. Procedure:
1 Reboot the system.
2 Open the Windows input prompt "Start > Run...", enter the command "cmd" and then <ENTER>.
3 Switch off the EWF by entering the command "ewfmgr c: -commitanddisable" and then <ENTER>.
4 Quit the input prompt by entering "exit" and then <ENTER>.
5 Reboot the system.
6 Copy the "REGFILTER.zip" file into a directory on your computer and unpack the file.
7 Double-click the "REGFILTER_Patch.reg" Registry patch to execute it.
8 Switch on the EWF again with the command "ewfmgr c: -enable".
9 Reboot the system.

Below is the Registry patch for downloading.

Regfilter.zip ( 245 bytes )

Security information
In order to protect technical infrastructures, systems, machines and networks against cyber threats, it is necessary to implement – and continuously maintain – a holistic, state-of-the-art IT security concept. Siemens’ products and solutions constitute one element of such a concept. For more information about cyber security, please visit