004 - Common VSS error messages and troubleshooting

The Volume Shadow Copy Service or VSS, a Microsoft product that is included in Windows, is used to back up MS Exchange, MS SQL, MS SharePoint, system states and Hyper-V data.

Errors that present in the Agent can be seen in the Windows event logs. To view these, open the Windows Event Viewer and under Windows Logs, investigate the Application, Setup and System logs.

Whenever a VSS snapshot is created during a backup, a list of all available VSS providers will be logged in the Agent to assist with troubleshooting and support. If a specific provider has been selected for use via Tools > Options > Advanced, this will be indicated.

For more on how Redstor uses VSS, see Article 531.

Note:

• VSS is not used on UNC paths.
• If the disk space or the disk bandwidth runs out while a VSS freeze is in effect, the backup will fail.
• If VSS writers are missing or in a failed state, the backup is likely to fail.

Page contents

• General troubleshooting
• Unknown VSS or COM error and Exchange or SQL not being detected for VSS backup
• Warning: Unable to open file ... (The system cannot find the file specified)
• Warning: Failed to read security descriptor for file ... (Access is denied)
• VSS backups randomly fail if Sophos antivirus is installed
• VSS error in the Windows event log: Unexpected error on routine call
• Error: Could not add volume ... to VSS snapshot
• Error: ConvertStringSidToSid
• Re-registering DLLs to address repeat failures
• Backup fails due to nested volume limit

General troubleshooting

VSS is Microsoft's technology, so it is necessary to use Microsoft's tools when troubleshooting VSS issues. In the command prompt, the command vssadmin list writers will provide a list of all VSS writers and any error conditions that these are experiencing. The Windows event log may also provide details of any VSS errors.

In general terms, make sure that the machine is up to date with Windows Update and that there is sufficient shadow copy storage area space available on disk. Use the No limit setting if possible.

The shadow copy storage area size can also be set from the command line, specifying a new size and optionally a new location if desired.

Note: According to Microsoft, the usability limit for VSS is 64TB. Exceeding this volume will result in an error.

The following commands can be run from an elevated command prompt:

• To show the current volume shadow copy storage associations:

vssadmin list shadowstorage

• To resize the volume shadow copy storage:

vssadmin resize shadowstorage /on=X: /for=Y: /maxsize=Z

where X = drive holding the shadow copy storage
where Y = drive being shadow-copied (backed up)
where Z = new shadow copy storage size along with the unit size (e.g. 10GB)

E.g.: vssadmin resize shadowstorage /on=X: /for=Y: /maxsize=10GB

Run the 'vssadmin list shadowstorage' command again to validate the new volume shadow copy size.

Note: The above commands only work if a shadow storage area has been added before. 

• To add shadow storage area:

vssadmin add shadowstorage /for=Y: /on=X: /maxsize=Z

where X = drive holding the shadow copy storage
where Y = drive being shadow-copied (backed up)
where Z = new shadow copy storage size along with the unit size (e.g. 20GB)

E.g.: vssadmin add shadowstorage /for=d: /on=c: /maxsize=20GB

Unknown VSS or COM error and Exchange or SQL not being detected for VSS backup

When running a backup, you may encounter the following error:

Message: 10:05:06 Starting VSS snapshot
Error: 10:05:07 An error occurred trying to initialize VSS: Unknown VSS or COM error
Warning: 10:05:07 VSS could not be started and was disabled

Alternatively, you may find that the VSS writers are not shown in the Agent when trying to back up MS Exchange or MS SQL using VSS. A common cause of this issue is having the Redstor Pro 32-bit Agent installed on a 64-bit operating system. VSS will not function when running as 32-bit on a 64-bit machine. If using the default installation path, you may notice "(x86)" in the installation file or working paths, indicating that 32-bit program files are being used, e.g. C:\Program Files (x86)\Attix5 Pro\Backup Client SE\toBackup.

To resolve the issue, uninstall the 32-bit Agent, install the 64-bit Agent and reconnect to the Account. Make sure that you also reinstall any applicable plugins.

Warning: Unable to open file ... (The system cannot find the file specified)

This error message is seen when a file is in use and therefore being handled by VSS (VSS creates the GLOBALROOT snapshot path).

Warning: 21:48:35 Unable to open file: C:\Program Files\Catford Computers\Diagnostics\
ServiceHost_20100620192402.xml, reason:\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy191\
Program Files\Catford Computers\Diagnosticss\Diagnostics\ ServiceHost_20100620192402.xml 
(The system cannot find the file specified)

When you see this error, the problem is typically with VSS and often indicates that the snapshot of the file is not available as VSS has overwritten it if there is insufficient space. You may need to increase the volume shadow copy area as described above.

The cause may also be another VSS error, so check the event logs for volsnap or volume shadow copy errors.

Warning: Failed to read security descriptor for file ... (Access is denied)

This error message is seen when a file is in use and therefore being handled by VSS.

Warning: 21:47:05 Failed to read security descriptor for file: C:\Program Files\Catford Computers\
Diagnostics\ServiceHost_20100620192402.xml, reason: \\?\GLOBALROOT\Device\
HarddiskVolumeShadowCopy191\Program Files\Catford Computers\Diagnosticss\Diagnostics\
ServiceHost_20100620192402.xml (Access is denied)

This error occurs when the Redstor Pro service user does not have permission to access the original file, but is replicated here as the original file is in use and Redstor Pro is trying to access the snapshot copy. To resolve this error, ensure that the Redstor Pro service user has read access to all files that you wish to back up.

VSS backups randomly fail if Sophos antivirus is installed

The way in which the Sophos endpoint agent writes to the Windows registry causes the Volume Shadow Copy Service (VSS) to time out, which causes the backup to fail. To resolve, follow the steps provided by Sophos. See Microsoft's article for more information.

Volume shadow copy service error: Unexpected error on routine call
IVssAsrWriterBackup::GetAsrMetadata. hr = 0x80070001, Incorrect function.
Operation:Event PrepareForBackup

Error: Could not add volume ... to VSS snapshot

When a backup is initiated while a second VSS writer is already running, you may encounter the following error:

Backup failed to complete: Could not add volume '\\?\Volume{389776ff-0dc1-11e4-93e8-806e6f6e6963}\' 
to VSS snapshot (0x8004230f; unexpected provider error)

How to address this

1. Run the command-line vssadmin list writers. Depending on the Windows roles and products installed, the number of writers that is displayed will vary. In a healthy system, all reports should read as [1] Stable with No error, as seen below.

2. If any of the writers reports as anything other than [1] Stable, you need to restart the VSS service. The list below shows which service you need to restart based on which VSS writer has failed.

3. After restarting the service, run the vssadmin command again to check whether the relevant writer is still in a failed state. If there is no improvement, a full reboot of the server is required.

4. If the issue persists, check the event logs from around the time of the error and check the VSS service for errors. Please check these against Microsoft's lists of VSS events.

5. If you need any assistance, please log a ticket containing:

• the Windows Application and System Event Logs in .evtx format
• the device name
• the output file of the following commands:
  • vssadmin list writers >C:\writers.txt
  • vssadmin list providers >C:\providers.txt
  • vssadmin list shadows >C:\shadows.txt
  • vssadmin list shadowstorage >C:\shadowstorage.txt
• the number of disks that you have, plus the free disk space on each

Error: ConvertStringSidToSid

In the following error

Error: A VSS error occurred in the Windows event log. See FAQ https://bit.ly/2KQA9WI: 'source: VSS, level: Error, message: ConvertStringSidToSid(S-1-5-80-3919359670-3540430778-4246408611-3681914861-206046543.bak)0x80070539, The security ID structure is invalid.Operation: OnIdentify event Gathering Writer Data Context: Execution Context: Shadow Copy Optimization Writer Writer Class Id: {4dc3bdd4-ab48-4d07-adb0-3bee2926fd7f} Writer Name: Shadow Copy Optimization Writer Writer Instance ID: {b85e7187-0689-495e-9347-6d76f2eae01c}' 

the function ConvertStringSidToSid indicates an issue in the Windows Registry. This usually refers to when we try to backup the Registry via VSS but certain aspects cannot be fixed, as they are unreadable. One of these aspects is user accounts that have been removed and are stuck in SID format.

To resolve this, see this forum post and the first answer about going into the Registry and removing SIDs with .bak.

Re-registering DLLs to address repeat failures

If you encounter unusual errors (e.g. “Writer Infrastructure failed” or “Could not determine if VSS snapshots supported”) and repeat failures in VSS for no apparent reason, you can re-register the DLLs associated with the VSS writers, as shown below.

1. First, run the following from an elevated command prompt:
sfc /scannow

If the Windows System File Checker finds any errors, it should fix them (or give you information on them if it cannot fix them automatically).

2. If this does not resolve the problem, run the following series of commands:

net stop "System Event Notification Service" 
net stop "Background Intelligent Transfer Service" 
net stop "COM+ Event System" 
net stop "Microsoft Software Shadow Copy Provider" 
net stop "Volume Shadow Copy" 
cd /d %windir%\system32 
net stop vss 
net stop swprv 
net stop SQLWriter 
regsvr32 /s ATL.DLL 
regsvr32 /s comsvcs.DLL 
regsvr32 /s credui.DLL 
regsvr32 /s CRYPTNET.DLL 
regsvr32 /s CRYPTUI.DLL 
regsvr32 /s dhcpqec.DLL 
regsvr32 /s dssenh.DLL 
regsvr32 /s eapqec.DLL 
regsvr32 /s esscli.DLL
regsvr32 /s FastProx.DLL
regsvr32 /s FirewallAPI.DLL
regsvr32 /s kmsvc.DLL
regsvr32 /s lsmproxy.DLL
regsvr32 /s MSCTF.DLL
regsvr32 /s msi.DLL
regsvr32 /s msxml3.DLL 
regsvr32 /s ncprov.DLL
regsvr32 /s ole32.DLL 
regsvr32 /s OLEACC.DLL 
regsvr32 /s OLEAUT32.DLL 
regsvr32 /s PROPSYS.DLL 
regsvr32 /s QAgent.DLL 
regsvr32 /s qagentrt.DLL 
regsvr32 /s QUtil.DLL 
regsvr32 /s raschap.DLL 
regsvr32 /s RASQEC.DLL 
regsvr32 /s rastls.DLL 
regsvr32 /s repdrvfs.DLL 
regsvr32 /s RPCRT4.DLL 
regsvr32 /s rsaenh.DLL 
regsvr32 /s SHELL32.DLL 
regsvr32 /S SQLVDI.DLL 
regsvr32 /s shsvcs.DLL 
regsvr32 /s /i swprv.DLL 
regsvr32 /s tschannel.DLL 
regsvr32 /s USERENV.DLL 
regsvr32 /s vss_ps.DLL 
regsvr32 /s wbemcons.DLL 
regsvr32 /s wbemcore.DLL 
regsvr32 /s wbemess.DLL 
regsvr32 /s wbemsvc.DLL 
regsvr32 /s WINHTTP.DLL 
regsvr32 /s WINTRUST.DLL 
regsvr32 /s wmiprvsd.DLL 
regsvr32 /s wmisvc.DLL 
regsvr32 /s wmiutils.DLL 
regsvr32 /s wuaueng.DLL 
sfc /SCANFILE=%windir%\system32\catsrv.DLL 
sfc /SCANFILE=%windir%\system32\catsrvut.DLL 
sfc /SCANFILE=%windir%\system32\CLBCatQ.DLL 
net start "COM+ Event System" 
net start vss 
net start swprv 
net start SQLWriter

This re-registers the DLLs for the VSS writers, which should resolve this type of issue.

Backup fails due to nested volume limit (0x8004232c)

This will be seen on a VM host if the volume it is attempting to backup is available on the host as well as  on the the VM, for example:

• on attempting to create a shadow copy of a volume that resides on a VHD that is contained in another VHD; or
• on attempting to create a shadow copy of a VHD volume when the volume that contains the VHD is also in the same shadow copy set.

These scenarios mean the volume is "nested" too deeply to participate in the VSS operation, resulting in a logic failure between the host VSS writers and VM VSS writers.

To resolve this, check all drive volumes on the host machine and make sure none are mapped drives or VHDs assigned to VMs.