Microsoft has published a workaround for the case that you use EWF and that WinSAT is included in your image and it consumes too much memory.

The article is about the following scenario:

  • You develop a Windows Embedded Standard 7 or Windows Embedded Standard 7 Service Pack 1 image for your device.
  • You added “Performance Monitoring” package in your answer file using Image Configuration Editor.
  • You added “Enhanced Write Filter with HORM” package in your answer file to protect the system (C:) volume.
  • You deployed your image without executing “winsat prepop”.
  • You enabled EWF for the runtime image.

The complete article including the workaround can be found here.