Ошибка vss 12292

Добрый день!

Прошу вас помочь разобраться с работой службы архивации сервера (Windows Server 2016). После заражения системы вирусом и дальнейшего его устранения, перестала работать архивация данных. При запуске через любой архивации (По расписанию или
Однократной) выдает в журнале следующие ошибки :

____________________________________________________

Проверка модулей записи VSS

Проверка модулей записи VSS

Проверка распределения хранилища теневой копии

Backup fails with VSS event ID 12292 and 11 on Windows Server

This article discusses an issue where backup operation using Windows Server Backup or a third-party backup application fails.

Applies to: В Windows Server 2012 R2
Original KB number: В 2009513

Symptoms

A backup operation using Windows Server Backup or a third-party backup application fails on Windows Server.

In the System event log, the following event is logged:

Log Name: System
Source: Service Control Manager
Event ID: 7023
Level: Error
Description:
The Microsoft Software Shadow Copy Provider service terminated with the following error:
The system cannot find the file specified.

In the Application event log, the following events are logged:

Log Name: Application
Source: VSS
Event ID: 12292
Level: Error
Description:
Volume Shadow Copy Service error: Error creating the Shadow Copy Provider COM class with CLSID <65ee1dba-8ff4-4a58-ac1c-3470ee2f376a>[0x80080005].
Operation:
Obtain a callable interface for this provider
Obtaining provider management interface
Context:
Provider ID:
Class ID: <00000000-0000-0000-0000-000000000000>
Snapshot Context: -1
Provider ID:
Log Name: Application
Source: VSS
Event ID: 11
Level: Error
Description:
Volume Shadow Copy Service information: The COM Server with CLSID <65ee1dba-8ff4-4a58-ac1c-3470ee2f376a>and name SW_PROV cannot be started. Most likely the CPU is under heavy load. [0x80080005]
Operation:
Obtain a callable interface for this provider
Obtaining provider management interface
Context:
Provider ID:
Class ID: <00000000-0000-0000-0000-000000000000>
Snapshot Context: -1
Provider ID:

On Windows Server 2008, if Windows Server Backup was used to perform the backup, the backup operation fails with one of the following errors:

Failed to create the shadow copy on the storage location.
ERROR — Volume Shadow Copy Service operation error (0x8004230f)
The shadow copy provider had an unexpected error while trying to process the specified operation.

The creation of the shadow copy on the backup destination failed.
The volume shadow copy operation failed with error 0x8004230F.
View the event log for more information.

On Windows Server 2008 R2, if Windows Server Backup was used to perform the backup, the backup operation fails with one of the following errors:

Windows Backup failed to create the shadow copy on the storage location.

The creation of the shadow copy on the backup storage destination failed.

Cause

This issue can occur if the ServiceDll registry value for Swprv is missing or incorrect.

Resolution

To resolve this issue, perform the following steps:

Click Start, type regedit in the Start Search box, and hit Enter.

Locate and then click the following registry key:

If the Parameters registry key is missing, perform the following steps: Right-click the swprv registry key, select New, select Key, type Parameters and hit Enter.

Once the Parameters registry key is selected, verify that the ServiceDll registry value has the following value:

If the ServiceDll registry value is missing, perform the following steps:

1. Right-click the Parameters registry key, select New, and then select Expandable String Value.
2. For the value name, type ServiceDll and hit Enter.
3. Double-click the ServiceDll registry value.
4. In the Value Data box, type %Systemroot%System32swprv.dll, and then click OK.

Perform a backup operation to verify that the issue is resolved.

Источник

Backup Or Copy Fails With The Error “VSS: Can’t Read Volume Data”

Scenario

You’re backing up or copying a disk, The operation fails, and you get a dialogue window with “VSS: can’t read volume data”

Reason 1

Filesystem or disk errors. This usually results from subtle errors in filesystem data. Windows does a good job in ignoring them, but our programs can’t always do that.

Solution 1

You need to correct them with the Windows checkdisk tool.

#1. Launch an elevated command prompt. On Windows 7: Start > All Programs > Accessories > find Command Prompt and right click it > Run as administrator. On Windows 8: right click the faux Start button area > Command Prompt (Admin).

Where X is substituted with the letter of one of the volumes involved in the intended operation (the one you’re trying to back up). The flags /f and/r tell the program to look for filesystem and disk errors and correct them. The program may require restart, in this case input Y > Enter and reboot the computer.

#3. Repeat #2 for every other volume involved in the operation.

Afterwards, run the operation again and see if this helped.

Reason 2

Outdated version of the program. Under some conditions, this could occur in older versions of our software (prior to generation 12).

Solution 2

If you’re using one of those, and solution #1 doesn’t help, upgrading should solve the problem.

If you’re still encountering the issue, please send the following additional information to our Support Team:

Run Command Prompt (Administrator), type:

vssadmin list writers
vssadmin list providers

Send the output (either copy text or make a screenshot).

Everyone once in awhile my system will lockup for a few seconds and i check event viewer and see this, What should i do to remedy the situation.

Event ID 8193

Log Name:      Application
Source:        VSS
Date:          7/22/2018 12:54:52 PM
Event ID:      8193
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      DESKTOP-O27N58L
Description:
Volume Shadow Copy Service error: Unexpected error calling routine GetProviderMgmtInterface.  hr = 0x8004230f, The shadow copy provider had an unexpected error while trying to process the specified operation.
. 
Event Xml:
<Event xmlns=»http://schemas.microsoft.com/win/2004/08/events/event»>
  <System>
    <Provider Name=»VSS» />
    <EventID Qualifiers=»0″>8193</EventID>
    <Level>2</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime=»2018-07-22T19:54:52.217834500Z» />
    <EventRecordID>2033</EventRecordID>
    <Channel>Application</Channel>
    <Computer>DESKTOP-O27N58L</Computer>
    <Security />
  </System>
  <EventData>
    <Data>GetProviderMgmtInterface</Data>
    <Data>0x8004230f, The shadow copy provider had an unexpected error while trying to process the specified operation.
</Data>
    <Data>
    </Data>
    <Binary>2D20436F64653A20565353415049435030303030303531392D2043616C6C3A20565353415049435030303030303438312D205049443A202030303030383336382D205449443A202030303031353332302D20434D443A2020633A5C77696E646F77735C73797374656D33325C737663686F73742E657865202D6B206C6F63616C73797374656D6E6574776F726B72657374726963746564202D70202D732053746F725376632020202D20557365723A204E616D653A204E5420415554484F524954595C53595354454D2C205349443A532D312D352D313820</Binary>
  </EventData>
</Event>

Next error

Last error code

Log Name:      Application
Source:        VSS
Date:          7/22/2018 12:54:52 PM
Event ID:      13
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      DESKTOP-O27N58L
Description:
Volume Shadow Copy Service information: The COM Server with CLSID {65ee1dba-8ff4-4a58-ac1c-3470ee2f376a} and name SW_PROV cannot be started. [0x80070422, The service cannot be started, either because it is disabled or because it has no enabled devices associated
with it.
] 

Operation:
   Obtain a callable interface for this provider
   Obtaining provider management interface

Context:
   Provider ID: {b5946137-7b9f-4925-af80-51abd60b20d5}
   Class ID: {00000000-0000-0000-0000-000000000000}
   Snapshot Context: -1
   Provider ID: {b5946137-7b9f-4925-af80-51abd60b20d5}
Event Xml:
<Event xmlns=»http://schemas.microsoft.com/win/2004/08/events/event»>
  <System>
    <Provider Name=»VSS» />
    <EventID Qualifiers=»0″>13</EventID>
    <Level>2</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime=»2018-07-22T19:54:52.215835300Z» />
    <EventRecordID>2031</EventRecordID>
    <Channel>Application</Channel>
    <Computer>DESKTOP-O27N58L</Computer>
    <Security />
  </System>
  <EventData>
    <Data>{65ee1dba-8ff4-4a58-ac1c-3470ee2f376a}</Data>
    <Data>SW_PROV</Data>
    <Data>0x80070422, The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.
</Data>
    <Data>

Operation:
   Obtain a callable interface for this provider
   Obtaining provider management interface

Context:
   Provider ID: {b5946137-7b9f-4925-af80-51abd60b20d5}
   Class ID: {00000000-0000-0000-0000-000000000000}
   Snapshot Context: -1
   Provider ID: {b5946137-7b9f-4925-af80-51abd60b20d5}</Data>
    <Binary>2D20436F64653A20434F52534F46544330303030303037372D2043616C6C3A20434F52534F46544330303030303036322D205049443A202030303030383238302D205449443A202030303031383333362D20434D443A2020433A5C57696E646F77735C73797374656D33325C76737376632E6578652020202D20557365723A204E616D653A204E5420415554484F524954595C53595354454D2C205349443A532D312D352D313820</Binary>
  </EventData>
</Event>

Everyone once in awhile my system will lockup for a few seconds and i check event viewer and see this, What should i do to remedy the situation.

Event ID 8193

Log Name:      Application
Source:        VSS
Date:          7/22/2018 12:54:52 PM
Event ID:      8193
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      DESKTOP-O27N58L
Description:
Volume Shadow Copy Service error: Unexpected error calling routine GetProviderMgmtInterface.  hr = 0x8004230f, The shadow copy provider had an unexpected error while trying to process the specified operation.
. 
Event Xml:
<Event xmlns=»http://schemas.microsoft.com/win/2004/08/events/event»>
  <System>
    <Provider Name=»VSS» />
    <EventID Qualifiers=»0″>8193</EventID>
    <Level>2</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime=»2018-07-22T19:54:52.217834500Z» />
    <EventRecordID>2033</EventRecordID>
    <Channel>Application</Channel>
    <Computer>DESKTOP-O27N58L</Computer>
    <Security />
  </System>
  <EventData>
    <Data>GetProviderMgmtInterface</Data>
    <Data>0x8004230f, The shadow copy provider had an unexpected error while trying to process the specified operation.
</Data>
    <Data>
    </Data>
    <Binary>2D20436F64653A20565353415049435030303030303531392D2043616C6C3A20565353415049435030303030303438312D205049443A202030303030383336382D205449443A202030303031353332302D20434D443A2020633A5C77696E646F77735C73797374656D33325C737663686F73742E657865202D6B206C6F63616C73797374656D6E6574776F726B72657374726963746564202D70202D732053746F725376632020202D20557365723A204E616D653A204E5420415554484F524954595C53595354454D2C205349443A532D312D352D313820</Binary>
  </EventData>
</Event>

Next error

Last error code

Log Name:      Application
Source:        VSS
Date:          7/22/2018 12:54:52 PM
Event ID:      13
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      DESKTOP-O27N58L
Description:
Volume Shadow Copy Service information: The COM Server with CLSID {65ee1dba-8ff4-4a58-ac1c-3470ee2f376a} and name SW_PROV cannot be started. [0x80070422, The service cannot be started, either because it is disabled or because it has no enabled devices associated
with it.
] 

Operation:
   Obtain a callable interface for this provider
   Obtaining provider management interface

Context:
   Provider ID: {b5946137-7b9f-4925-af80-51abd60b20d5}
   Class ID: {00000000-0000-0000-0000-000000000000}
   Snapshot Context: -1
   Provider ID: {b5946137-7b9f-4925-af80-51abd60b20d5}
Event Xml:
<Event xmlns=»http://schemas.microsoft.com/win/2004/08/events/event»>
  <System>
    <Provider Name=»VSS» />
    <EventID Qualifiers=»0″>13</EventID>
    <Level>2</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime=»2018-07-22T19:54:52.215835300Z» />
    <EventRecordID>2031</EventRecordID>
    <Channel>Application</Channel>
    <Computer>DESKTOP-O27N58L</Computer>
    <Security />
  </System>
  <EventData>
    <Data>{65ee1dba-8ff4-4a58-ac1c-3470ee2f376a}</Data>
    <Data>SW_PROV</Data>
    <Data>0x80070422, The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.
</Data>
    <Data>

Operation:
   Obtain a callable interface for this provider
   Obtaining provider management interface

Context:
   Provider ID: {b5946137-7b9f-4925-af80-51abd60b20d5}
   Class ID: {00000000-0000-0000-0000-000000000000}
   Snapshot Context: -1
   Provider ID: {b5946137-7b9f-4925-af80-51abd60b20d5}</Data>
    <Binary>2D20436F64653A20434F52534F46544330303030303037372D2043616C6C3A20434F52534F46544330303030303036322D205049443A202030303030383238302D205449443A202030303031383333362D20434D443A2020433A5C57696E646F77735C73797374656D33325C76737376632E6578652020202D20557365723A204E616D653A204E5420415554484F524954595C53595354454D2C205349443A532D312D352D313820</Binary>
  </EventData>
</Event>