So of course with write cache filling up issues no simple way to tell what’s going on. Needless to say like most quirks that happen in Windows the sysinternals tools can come to you rescue.
Recently started work on a windows 10 PVS image and after about 10 minutes the write cache would fill up.
So using Procmon (https://technet.microsoft.com/en-us/sysinternals/processmonitor.aspx) was able to determine what was going on.
In order though to filter out the extraneous stuff found the following 2 filters gave me info on the offenders.
To do click Filter and filter out everything except write activity by making two filters as follows:
Operation begins with WriteFile Include
Operation begins with WriteConfig Include
and you’ll be on our way.