Environment: IGEL Windows 10 IoT 4.02.100


When the thin client wakes after a longer period of time in sleep mode, e. g. over the weekend, various anomalies are experienced.

Examples include:

  • The logon screen is missing.
  • After logon, the start menu is missing.
  • When you sign out, the "Signing out" screen appears, but never finishes.
  • ...


The problem is caused by the combined use of the Unified Write Filter (UWF) and Windows Defender. As of Windows 10 IoT 4.02.100, Windows Defender antimalware definition updates are enabled by default. At the same time, it is normal behavior of the UWF that the overlay will grow no matter a path is excluded from the UWF. When Windows Defender definition updates are executed, the overlay usage grows to about a few hundred megabytes. This causes excess memory consumption, which results in the described anomalies.

You can learn more in the chapter Unified Write Filter (UWF).


The recommended solution is to configure Windows Defender for scheduled definition updates with IGEL Setup, see Windows Defender. In schedule mode, the UWF is automatically deactivated during definition updates.

Legal Note

IGEL's Terms & Conditions apply.