Volume shadow copy service error unexpected error calling routine regopenkeyexw

The monitoring system on one of my servers running Windows Server 2016 started sending multiple messages of the Volume Shadow Copy Service error with the Event ID 8193 and VSS as a source. The full error description in the Event Viewer (Application log) looks like this:

Volume Shadow Copy Service error: Unexpected error calling routine RegOpenKeyExW (-2147483646, SYSTEMCurrentControlSetServicesVSSDiag,...).  hr = 0x80070005, Access is denied.
Operation:
Initializing Writer
Context:
%MINIFYHTMLb5bdc426b817a5035bf92ebd42cdf8ae5%Writer Class Id: {e8132975-6f93-4464-a53e-1050253ae220}
Writer Name: System Writer
Writer Instance ID: {4f096fb4-2e00-4864-aa8f-885aa9186850}

At the same time, the server is working fine, and there were no visible problems with the services or apps. There were no errors in the list of VSS modules for the instance ID of VSS Writer.

vss list writers

VSS EventID 8193 is a known error that is generally related to the installation of the DHCP role on a server running Windows Server 2008 (or newer) resulting in the Network Service account losing the permissions on the registry key HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesVSSDiag.

The problem is related to the installation of the VSS module – DHCP Jet Writer, which is responsible for correct shadow copy creation of the DHCP service. This VSS module changes permissions on the specified registry key during installation.

To fix this error, you have to manually grant the Full Control permission for Network Service on the specified key.

1. Run the Registry Editor (regedit.exe);
2. Go to the registry key HKLMSYSTEMCurrentControlSetservicesVSSDiag and open its permissions (Permissions option in the context menu);
3. Find Network Service in the list and assign the Full Control permissions.

Instead of editing the registry manually, it would be more correct to restore the default permissions on the registry key using a special command CLI tool – SubInACL. Download and install it (if you have not done it yet) and run the following commands:

cd “C:Program Files (x86)Windows Resource KitsTools”
subinacl.exe /Subkeyreg SystemCurrentControlSetServicesVSSDiag /sddl=D:PAI(A;;KA;;;BA)(A;;KA;;;SY)(A;;CCDCLCSWRPSDRC;;;BO)(A;;CCDCLCSWRPSDRC;;;LS)(A;;CCDCLCSWRPSDRC;;;NS)(A;CIIO;RC;;;OW)(A;;KR;;;BU)(A;CIIO;GR;;;BU)(A;CIIO;GA;;;BA)(A;CIIO;GA;;;BO)(A;CIIO;GA;;;LS)(A;CIIO;GA;;;NS)(A;CIIO;GA;;;SY)(A;CI;CCDCLCSW;;;S-1-5-80-3273805168-4048181553-3172130058-210131473-390205191)(A;ID;KR;;;AC)(A;CIIOID;GR;;;AC)S:ARAI

In Windows Server 2008 R2, the command will look like this (according to Microsoft KB):

subinacl.exe /Subkeyreg SystemCurrentControlSetServicesVSSDiag /sddl=O:SYG:SYD:PAI(A;;KA;;;BA)(A;;KA;;;SY)(A;;SDGRGW;;;BO)(A;;SDGRGW;;;LS)(A;;SDGRGW;;;NS)(A;CIIO;RC;;;S-1-3-4)(A;;KR;;;BU)(A;CIIO;GR;;;BU)(A;CIIO;GA;;;BA)(A;CIIO;GA;;;BO)(A;CIIO;GA;;;LS)(A;CIIO;GA;;;NS)(A;CIIO;GA;;;SY)(A;CI;CCDCLCSW;;;S-1-5-80-3273805168-4048181553-3172130058-210131473-390205191)

Then replace the permissions on the child (nested) objects in the Registry Editor. To do it, open the Diag reg key properties and click “Permissions” -> “Advanced” -> “Replace all child object permissions”.

Then just restart your Windows.

PS. When writing this article I found out that there was another VSS error with the same (!!!) EventID 8193 and the following description:

Volume Shadow Copy Service error: Unexpected error calling routine ConvertStringSidToSid(S-1-5-21-2470146651-3958396388-212345117-21232.bak).  hr = 0x80070539,The security ID structure is invalid.
Operation:
OnIdentify event
Gathering Writer Data
Context:
Execution Context: Shadow Copy Optimization Writer
Writer Class Id: {4dc3bdd4-ab48-4d07-adb0-3bee2926fd7f}
Writer Name: Shadow Copy Optimization Writer
Writer Instance ID: {5e5d68e6-9c97-4af6-a09f-bb2db4c65058}.

To make the article comprehensive, I will describe the solution of this issue as well.

This error doesn’t allow you to create system state backup or backup your Hyper-V VMs (through the Windows Server Backup), which leads to the following error: “0x80042308: The specified object was not found”.

This problem is solved differently and related to the incorrect entry in the profile’s reg key HKLMSoftwareMicrosoftWindows NTCurrentVersionProfileList. The issue occurs due to VSS service (Shadow Copy Optimization Writer component) cannot find a user profile with the SID ending in .bak and returns an error. You need to delete the registry key shown in the description of the ConvertStringSidToSid event (S-1-5-21-2470146651-3958396388-212345117-21232.bak).

1. Open the regedit.exe;
2. Go to the HKLMSoftwareMicrosoftWindows NTCurrentVersionProfileList;
3. Find and delete the registry key with the .bak suffix;
4. Restart your computer and try to run your backup task again.

Исправление ошибки VSS EventID 8193 в Windows Server 2016

Система мониторинга с одного из серверов с Windows Server 2016 при каждой загрузке сервера стала слать события с ошибкой службы теневого копирования томов в журнале Application с EventID 8193 от источника VSS:

При этом сервер работает нормально, каких-то видимых проблем со службами нет. В списке модулей VSS также нет ошибок для ID этого экземпляра VSS Writer:

vss list writers

Данная ошибка довольно старая и обычно связана с установкой DHCP роли на сервер Windows Server 2008 (и выше), после которого у учетной записи Network Service пропадают права на ветку реестра HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesVSSDiag.

Проблема связана с установкой модуля теневого копирования VSS — DHCP Jet Writer, отвечающего за корректное создание теневых копий DHCP службы, который изменяет права на ветку.

Чтобы исправить ошибку нужно вручную с помощью редактора реестра предоставить полные права для Network Service на указанную ветку.

1. Запустите regedit.exe;
2. Перейдите к ветке HKLMSYSTEMCurrentControlSetservicesVSSDiag и откройте окно с правами на ветку реестра (пункт Permissions в контекстном меню);
3. В списке разрешений найдите Network Service и в разрешениях предоставьте полный доступ (Full Control).

Вместо ручной правки реестра более правильнее было бы восстановить стандартные права на нее с помощью утилиты командной строки SubInACL. Скачайте и установите утилиту, (если это еще не сделано) и выполните следующие команды:

В Windows Server 2008 R2 команда будет такая (согласно KB Microsoft):

Затем в редакторе реестра нужно выполнить замену разрешений на вложенные объекты. Для этого откройте свойства ключа Diag и выполните “Permissions” -> “Advanced” -> “Replace all child object permissions ….».

Осталось перезагрузить Windows.

PS. Уже в процесса написания статьи обнаружил что существует еще одна ошибка VSS с таким же (. ) EventID 8193 с описанием:

Чтобы статья была более полной, оставлю тут метод решения и этой ошибки.

Данная ошибка препятствует выполнению резервному копирования системы (System State Backup) с помощь Windows Server Backup, который завершается с ошибкой “0x80042308: The specified object was not found ».

Проблема решается по другому и связана с наличием некорректной записи в ветке реестра с профилями пользователей HKLMSoftwareMicrosoftWindows NTCurrentVersionProfileList. Связано с тем, что служба VSS (компонент Shadow Copy Optimization Writer ) не может найти профиль пользователя с SID, оканчивающимся на .bak и выпадает в ошибку. Нужно удалить ключ реестра, который указан в описании события ConvertStringSidToSid(S-1-5-21-2470146651-3958396388-212345117-21232.bak).

1. Откройте regedit.exe;
2. Перейдите в ветку HKLMSoftwareMicrosoftWindows NTCurrentVersionProfileList;
3. Найдите и удалите ветку реестра с суффиксом .bak;
4. Перезагрузите сервер и попробуйте выполнить резервное копирование.

Источник

Volume shadow copy service error unexpected error calling

This forum has migrated to Microsoft Q&A. Visit Microsoft Q&A to post new questions.

Answered by:

Question

I’m seeing numerous events logged on our Windows Server 2012 R2 servers, relating to the Volume Shadow Copy Service. They only seem to occur on 2012 R2 servers with both Active Directory and DHCP roles installed. Seems to be a registry permissions problem, but the only solutions I can find via Google are for 2008 R2 servers and the solution doesn’t work on 2012 R2 servers.

«Volume Shadow Copy Service error: Unexpected error calling routine RegOpenKeyExW(-2147483646,SYSTEMCurrentControlSetServicesVSSDiag. ). hr = 0x80070005, Access is denied.

Operation:
Initializing Writer

«Volume Shadow Copy Service error: Unexpected error calling routine RegOpenKeyExW(-2147483646,SYSTEMCurrentControlSetServicesVSSDiag. ). hr = 0x80070005, Access is denied.

Operation:
Initializing Writer

«Volume Shadow Copy Service error: Unexpected error calling routine RegOpenKeyExW(-2147483646,SYSTEMCurrentControlSetServicesVSSDiag. ). hr = 0x80070005, Access is denied.

Operation:
Initializing Writer

Is there a 2012 R2 solution to this problem?

Источник

Hyper-V backup job fails to create shadow copy with default shadow storage limit

Cheers for trusting us with the spot in your mailbox!

Now you’re less likely to miss what’s been brewing in our knowledge base with this weekly digest

Oops! Something went wrong.

Challenge

Backup or replication of a Hyper-V VM fails. In the Windows event logs on the Hyper-V host server, there is an error with ID 8193 from source VSS:

Volume Shadow Copy Service error: Unexpected error calling routine Cannot find anymore diff area candidates for volume \?Volume [0].

Note: This KB specifically addresses the error “cannot find anymore diff area candidates for volume.” There are a variety of possible VSS errors with ID 8193.

Veeam Backup & Replication reports a general error about snapshot creation failure:

Unable to create snapshot (Microsoft Software Shadow Copy provider 1.0) (mode: Crash consistent). Details: Unknown status of async operation
The shadow copy provider had an unexpected error while trying to process the specified operation.
—tr:Failed to create VSS snapshot.
—tr:Failed to perform pre-backup tasks.

Cause

Solution

Increase the shadow copy storage area for the volume listed in the error event, or set the maximum size to “No limit.”

To identify the volume listed in the event, run “mountvol” from a command prompt ; below the usage information will be a list of volume GUIDs and their associated mount points, if any.

This size of the shadow storage area can be changed in the Shadow Copies utility, or from the command line.

Note: By default, each volume stores its own shadow copy. For example, a shadow copy of a CSV mapped to C:ClusterStorageVolume8 would also be stored on C:ClusterStorageVolume8. Do not change the location of the shadow copy storage area on a Hyper-V host server.

Shadow Copies Utility

To access the utility, right click any volume and choose Configure Shadow Copies.

In the Shadow Copies utility:

1. Select the volume with insufficient space;
2. Click Settings…
3. In the “Maximum size” box, either increase the limit, or choose “No limit”.

A limit at least 20% of the total volume size may be needed on busy servers.

All commands below should be run from an administrator command prompt.

Use vssadmin list shadowstorage to view existing shadow storage associations. If no association exists for any volume, the command response will be “No items found that satisfy the query.”

If no association is listed for the volume, run vssadmin add shadowstorage to set the size of the shadow storage area. For example, on a 1 TB volume labeled D:

vssadmin add shadowstorage /for=D: /on=D: /maxsize=200GB

If a shadow storage association already exists, run vssadmin resize shadowstorage to set the size of the shadow storage area. For example, on a 1 TB volume labeled D:

vssadmin resize shadowstorage /for=D: /on=D: /maxsize=200GB

The /maxsize parameter is not optional, but can be set as /maxsize=UNBOUNDED

Источник

Volume shadow copy service error unexpected error calling

This forum has migrated to Microsoft Q&A. Visit Microsoft Q&A to post new questions.

Asked by:

Question

We have a reoccurring event 8193. From what I could gather on line this is regarding a backup issue with the SID. Non the less, would like to cover all my bases since have not found anything specific for this faulty module.

Can someone help me out with the basics: Where is this coming from? Do we need to take up any measures? is this high impact? how to resolved if needed.

Thank you all in advanced.

Volume Shadow Copy Service error: Unexpected error calling routine ConvertStringSidToSid(S-1-5-21-3912081775-2972631207-1420028119-2182.bak). hr = 0x80070539, The security ID structure is invalid.

Gathering Writer Data

Execution Context: Shadow Copy Optimization Writer

Writer Class Id:

Writer Name: Shadow Copy Optimization Writer

Writer Instance ID:

Please make sure that all your VSS writers are in stable state, you can check it with the following command:

This issue may be caused by an invalid entry inside the following registry sub tree:

Please open the registry editor by typing «regedit» in Run or in the Stary Menu.
Then expand and navigate to the above registry subtree, check if there is an entry that has a «.bak» value appended.

If a «.bak» value exist, this may be cause the failure when trying to resolve the SID of the writer.

Please backup the registry key first before doing any changes , then delete that entry with the extra «.bak», and finally reboot the problematic server and check if the issue is resolved.

Blog: https://thesystemcenterblog.com LinkedIn:

Thanks for posting in our forum!

1. What backup tool do you use? if you use the third-party backup tool, please contact the tool veendor to seek help.

2. Please run «vssadmin list writers» and upload your screenshot.

3. Please try to uninstall AV software and try again.

4. For error event 8193 usually indicates that an unexpected Volume Shadow Copy Service (VSS) error has occurred

And according to your error message, it is related to that the .bak file is not working as expected.

Sine the failure may related to resolve the SID of the writer, we could backup the registry key first, and then delete that entry with the extra «.bak

And if you are consider about the problem, as suggested before, please backup the registry key first, you could restore the registry key to the original one in case something wrong.

Hope this can help you, please let me know if you have any question.

Источник

Volume shadow copy service error unexpected error calling

This forum has migrated to Microsoft Q&A. Visit Microsoft Q&A to post new questions.

Asked by:

Question

I have a problem and i cant fixed it, anyone can help me ?

Microsoft Windows Server 2012 R2 Standard

This is the issue what i have:

Log Name: Application
Source: VSS
Date: 20-3-2019 06:44:56
Event ID: 8193
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: xxxx.xxx.lan
Description:
Volume Shadow Copy Service error: Unexpected error calling routine CreateFileW(\.PHYSICALDRIVE1) — BuildLunInfoForDrive. hr = 0x80070020, The process cannot access the file because it is being used by another process.
.

How can i solve this issue.

Do you have any antivirus software installed? It sounds like something is blocking the file and the backup is failing because of it.

Try disabling the antivirus software completely if you have any installed.

Best regards,
Leon

Thanks for posting in our forum!

Do you use build-in feature windows server backup （ WSB) to do the backup? If not, please disable 3rd party software, use windows server backup and check the results.

Please check if all your VSS writers are in stable state. You can run “Vssadmin list Writers”

Please uninstall all anti-virus software and try again 。

Please make sure VSS Service works properly

In addition, for more information about Event Id 8193, please see:

Hope this information can help you, if you have any question, please feel free to let me know.

Please remember to mark the replies as answers if they help.
If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

We are using VeeamBackup and Bitdefender.

VSS services are on manual state.

Try uninstalling Bitdefender and try again.

Please remember to mark the replies as answers if they help.
If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

• Proposed as answer by Danie1zhou Microsoft contingent staff Tuesday, March 26, 2019 7:25 AM

Since you are using a third party backup software, I would suggest you check in the Veeam Backup forums, you can find the forums in the link below:

By the way, BitDefender is known to cause locking issues, I would first suggest you test by disabling it or temporarily uninstall it to check if it helps, if it doesn’t help, try asking the experts over the Veeam forums.

Please remember to mark the replies as answers if they help.
If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

Please remember to mark the replies as answers if they help.
If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

WS2016 with DPM2019 Connected via 2 x iSCSI to EQL SAN with backups on SAN.

Getting similar if the same as the above as below in Error log Event 8193.

No AV except the defualt Windows 2016.

Latest Dell / EQL Hit kit installed..

VSSadmin list writers reports no problems.

The DPM Volume is ReFS which might be a problem ? (but needed for DPM), will check with Dell / EQL support also.

Any ideas, error log below.

Volume Shadow Copy Service error: Unexpected error calling routine CreateFileW(\.PHYSICALDRIVE10) — BuildLunInfoForDrive. hr = 0xc03a001c, The requested operation cannot be performed on the virtual disk in its current state.
.

Operation:
Check If Volume Is Supported by Provider
Check If Volume Is Supported by Provider

Context:
Device: \.PHYSICALDRIVE10
Device: \?Volume
Execution Context: Provider
Provider Name: Dell EqualLogic VSS HW Provider
Provider Version: 5.1.0
Provider ID:
Volume Name: \?Volume
Snapshot Context: -1
Execution Context: Coordinator
Provider ID:
Volume Name: \?Volume

Источник

While doing a SharePoint installation at one of my clients using AutoSPInstaller, I kept having problems with the SharePoint Search Provisioning. After looking in the Event Logs, I found that there was an Access Denied Error on a certain Registry Key. The Event ID is 8193. Usually, the Event Viewer shows you what account has an access denied, but this time it wasn’t the case!

Also, for Search purposes, here is the error from AutoSPInstaller

Exception : System.Management.Automation.MethodInvocationException: Exception calling “Unprovision” with “0” argument(s): “The executing code must run on server SPWFE1.” —> System.InvalidOperationException: The executing code must run on server SPWFE1.

And the error from the event viewer:

Volume Shadow Copy Service error: Unexpected error calling routine RegOpenKeyExW(-2147483646,SYSTEMCurrentControlSetServicesVSSDiag,…). hr = 0x80070005, Access is denied.

Operation:

Initializing Writer

Context:

Writer Class Id: {0ff1ce15-0201-0000-0000-000000000000}

Writer Name: OSearch15 VSS Writer

Writer Instance Name: OSearch15 Replication Service

Writer Instance ID: {a7e6cfde-ea80-43fa-b33e-e5b879a27133

So I went in the Event “Details” Tab to try and find more about the error, but at the first look, nothing displayed more info about the account name.

However, when we scroll down in the Event Viewer, there is a “Binary to Word” translation that helps us a lot more! When we look at it, we can see the account number on multiple lines!

It was my Services account who didn’t have access to a registry key! To fix the error, do the following steps >

1. Open regedit as an Administrator.

2. Navigate to HKLM > System > Current Control Set > Services

   

3. Then find the “VSS” folder!

   

4. Right click on the “VSS” folder. And then click on permissions,

   

5. Add the account that had an Access Denied and found earlier in the script and give it Full Control as it needs Read & Write to the VSS!

   

6. You should make sure that this account has access to the VSS Registry key on all the SharePoint Servers in the farm having a search Component. I recommend doing a reboot after changing the registry key, however it should work without one!

Now your Search provisioning should work without any problem!

Leave a comment and don’t forget to like the Vlad Talks Tech Page   on Facebook and to follow me on Twitter here  for the latest news and technical articles on SharePoint.  I am also a Pluralsight author, and you can view all the courses I created on my author page.