Microsoft has published a workaround for the case that you use EWF and that WinSAT is included in your image and it consumes too much memory.
The article is about the following scenario:
- You develop a Windows Embedded Standard 7 or Windows Embedded Standard 7 Service Pack 1 image for your device.
- You added "Performance Monitoring" package in your answer file using Image Configuration Editor.
- You added "Enhanced Write Filter with HORM" package in your answer file to protect the system (C:) volume.
- You deployed your image without executing "winsat prepop".
- You enabled EWF for the runtime image.
The complete article including the workaround can be found here.