Your approach using SAN policy 3 is a solid start to prevent automatic mounting and writing. However, for bypassing the critical disk restriction, you might need to use a lower-level filter driver or modify WinPE’s boot configuration to prevent Windows from treating the disk as critical. Have you explored using StorPort mini-filters or modifying registry settings in the PE environment before mounting? Also, setting the disk as read-only in the startnet.cmd script should prevent accidental writes, but testing with ProcMon could confirm if anything slips through. Let us know if you find a foolproof method.