Method Call from WMI - Write Filter UWF

Trying to inspect the status of Unified Write Filter to see what files and reg keys are in the filter and the best way via relevance seems to be WMI. I want to see what Exclusions are set. “You can use the UWF_RegistryFilter.GetExclusions or UWF_RegistryFilter.FindExclusion methods to retrieve UWF_ExcludedRegistryKey objects.”

Ive tried (selects “* from UWF_ExcludedFile” of wmi “root\standardcimv2\embedded”) as string but it returns nothing and multiple variations of what is listed in the docs. I cant seem to make a method call with Relevance to use UWF_RegistryFilter.GetExclusions

https://docs.microsoft.com/en-us/windows-hardware/customize/enterprise/uwf-excludedregistrykey

Any tips would be greatly appreciated!

Correct, in pure relevance we do not implement calling WMI Methods (only Selects are supported) to ensure Relevance remains a “read-only” capability.
You’ve need to issue an Action to call a WMI method, store the results, and read back the results in an Analysis. Gwmi or PowerShell or VBScript should all be able to do this.

As a follow up for future people I created a fixlet that runs the following every fifteen minutes.
Relevance:
(version of client >= "6.0.0.0") AND (exists true whose (if true then (exists (if (exists wmi) then (string value of select "Name from Win32_ComputerSystemProduct" of wmi) else ("N/A")) whose (it as string as lowercase contains "Thin Client" as lowercase)) else false))

Actionscript:

waithidden cmd /c "%systemdrive%\windows\sysnative\uwfmgr.exe file get-exclusions > %systemdrive%\ProgramData\uwffiles.txt"
waithidden cmd /c "%systemdrive%\windows\sysnative\uwfmgr.exe registry get-exclusions > %systemdrive%\ProgramData\uwfregistry.txt"

Analysis:
Write Filter Status
(select "CurrentEnabled from UWF_Filter" of wmi "root\StandardCimv2\Embedded") as string = "CurrentEnabled=True" as string

UWF Excluded Files

lines whose (it contains ":") of it of file "c:\ProgramData\uwffiles.txt" of encoding "UTF-16LE"

UWF Excluded Registry Keys

lines whose (it contains "\") of it of file "c:\ProgramData\uwfregistry.txt" of encoding "UTF-16LE"

I started writing something (below) the file has %00 as every other character, and I have not had the time to get back to editing that. A way to do the same thing with the native command instead of WMI.

action uses wow64 redirection {not x64 of operating system}

if {not exists folder "c:\uwfdata"}
	folder create "c:\uwfdata"
endif

delete __appendfile
delete "c:\uwfdata\run.bat"
appendfile uwfmgr.exe get-config >> c:\uwfdata\uwf.txt
move __appendfile "c:\uwfdata\run.bat"
delete "c:\uwfdata\uwf.txt"
dos c:\uwfdata\run.bat