Unified Write Filter - Enabled
Summary
This document outlines how to determine if an agent has the Unified Writer Filter enabled.
Settings
| Detection String | Comparator | Result | Applicable OS |
|---|---|---|---|
| `{@%powershell.exe -command "Get-WmiObject -Namespace "root/standardcimv2/embedded" -Class UWF_Filter | select -ExpandProperty CurrentEnabled"@%}` | Equals | True |
Changelog
2025-04-10
- Initial version of the document