Video Screencast Help

Backup completing with exception

Created: 11 Sep 2012 | 19 comments

Hi

whenever i am doing complete or differential backup on backup exec 2012, it  ejects the rdx tape at 100% and status still displaying backing up. When i put back the tape the job stops and says completed with exception.

i am told vss is not working. i can not also do the system backup either. below is the error message:

The backup options or selections for this job have changed since the last time it ran. You should run the full backup instance of this backup definition as soon as possible to ensure complete protection.
 

 

Backup- Foods-AD.foods.localdomain
- Snapshot Technology: Initialization failure on: "\\Foods-AD.foods.localdomain\D:". Snapshot technology used: Microsoft Volume Shadow Copy Service (VSS).
V-79-10000-11226 - VSS Snapshot error. The Microsoft Volume Shadow Copy Service (VSS) snapshot technology selected returned: "Unexpected provider error". Ensure that all provider services are enabled and can be started. Check the Windows Event Viewer for details. 

What shall be done?

I checked the vss service and it is operating. 

Comments 19 CommentsJump to latest comment

CraigV's picture

Hi,

 

Open up a command prompt on that server and type: vssadmin list writers. Any writers not stable and running are in error.

You can fix this in 1 of 2 ways:

1. Reboot the server...

2. Reregister the VSS *.dlls (it works with R2 too, used it plenty of times!) which doesn't require a restart:

http://www.symantec.com/business/support/index?page=content&id=TECH70486

Thanks!

Alternative ways to access Backup Exec Technical Support:

https://www-secure.symantec.com/connect/blogs/alte...

Colin Weaver's picture

Sorry CraigV but DO NOT USE the reregister VSS information with either 2008 or 2008 R2 it can break the server if you do (which is why TECH70486 has been pulled). For details read this:

 

 

As per Microsoft KB http://support.microsoft.com/kb/940184
Important This article is not for use with Windows Vista, with Windows Server 2008, or with later Windows operating systems. Starting with Windows Vista and with Windows Server 2008, Windows component installation is manifest-based. Trying to manually register specific components, as described in the following steps, can have unexpected results that may require you to reinstall Windows to resolve.

Symantec now have http://www.symantec.com/docs/TECH173983 covering that sort of info.

Note: We have had at leats one customer be broken by the re-register dll information in 2008 SBS server.

CraigV's picture

Thanks very much Colin! This is good to know. I have deleted the old bookmark & added this one in!

Alternative ways to access Backup Exec Technical Support:

https://www-secure.symantec.com/connect/blogs/alte...

marcusolini's picture

Hi.  When able, please collect the following diagnostic information using the native Windows command line tools and post the information for review.  Thank you.

(1)    C:\>VSSADMIN LIST VOLUMES

(2)    C:\>VSSADMIN LIST WRITERS

(3)    C:\>VSSADMIN LIST PROVIDERS

(4)    C:\>VSSADMIN LIST SHADOWS

(5)    C:\>VSSADMIN LIST SHADOWSTORAGE

(6)    C:\>REG QUERY "HKLM\SYSTEM\CurrentControlSet\Services\VSS"

(7)    C:\>REG QUERY "HKLM\SYSTEM\CurrentControlSet\Services\VSS\Providers" /s

(8)    C:\>REG QUERY "HKLM\SYSTEM\CurrentControlSet\Services\VSS\Settings" /s

(9)    C:\>REG QUERY "HKLM\SYSTEM\CurrentControlSet\Services\VSS\VssAccessControl" /s

(10)  C:\>REG QUERY "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP" /s

(11)  C:\>REG QUERY "HKLM\SYSTEM\CurrentControlSet\Services\MountMgr" /s

(12)  C:\>REG QUERY "HKLM\SYSTEM\CurrentControlSet\Services\TrueCrypt" /s

(13)  C:\>REG QUERY "HKLM\SYSTEM\CurrentControlSet\control\hivelist" /s

(14)  C:\>VER

(15)  C:\>BCDEDIT /ENUM

(16)  C:\>MOUNTVOL

(17)  C:\>DISKPART

(18)(a)   DISKPART> LIST DISK

(18)(b)   DISKPART> LIST VOLUME

(18)(c)   DISKPART> LIST VDISK

(18)(d)   DISKPART> EXIT

(19) Question: Physical Machine or Virtual Machine?

ncoowar's picture

1)

Volume path: C:\
    Volume name: \\?\Volume{d001b522-1814-11e0-93b8-806e6f6e6963}\
Volume path: G:\
    Volume name: \\?\Volume{cd2e77d6-a59d-11e1-b2a9-78e7d17aa4cd}\
Volume path: H:\
    Volume name: \\?\Volume{0e8231f1-c124-11e1-95bb-78e7d17aa4cd}\
Volume path: D:\
    Volume name: \\?\Volume{d001b523-1814-11e0-93b8-806e6f6e6963}\

2)

Writer name: 'Task Scheduler Writer'
   Writer Id: {d61d61c8-d73a-4eee-8cdd-f6f9786b7124}
   Writer Instance Id: {1bddd48e-5052-49db-9b07-b96f96727e6b}
   State: [1] Stable
   Last error: No error

Writer name: 'VSS Metadata Store Writer'
   Writer Id: {75dfb225-e2e4-4d39-9ac9-ffaff65ddf06}
   Writer Instance Id: {088e7a7d-09a8-4cc6-a609-ad90e75ddc93}
   State: [1] Stable
   Last error: No error

Writer name: 'Performance Counters Writer'
   Writer Id: {0bada1de-01a9-4625-8278-69e735f39dd2}
   Writer Instance Id: {f0086dda-9efc-47c5-8eb6-a944c3d09381}
   State: [1] Stable
   Last error: No error

Writer name: 'Microsoft Hyper-V VSS Writer'
   Writer Id: {66841cd4-6ded-4f4b-8f17-fd23f8ddc3de}
   Writer Instance Id: {8c4d0213-c795-48da-9b39-58a5f8c91b8f}
   State: [1] Stable
   Last error: No error

Writer name: 'System Writer'
   Writer Id: {e8132975-6f93-4464-a53e-1050253ae220}
   Writer Instance Id: {3f88df33-b9a0-4b38-a738-4d3db36ae5da}
   State: [1] Stable
   Last error: No error

Writer name: 'FRS Writer'
   Writer Id: {d76f5a28-3092-4589-ba48-2958fb88ce29}
   Writer Instance Id: {46d5583c-d501-4db4-983c-de0f1cd64575}
   State: [1] Stable
   Last error: No error

Writer name: 'SqlServerWriter'
   Writer Id: {a65faa63-5ea8-4ebc-9dbd-a0c4db26912a}
   Writer Instance Id: {27bee144-2f3b-48c3-b1e5-970d727e28b0}
   State: [1] Stable
   Last error: No error

Writer name: 'FSRM Writer'
   Writer Id: {12ce4370-5bb7-4c58-a76a-e5d5097e3674}
   Writer Instance Id: {96c45987-2e44-43ba-9bbf-acbc829aba0d}
   State: [1] Stable
   Last error: No error

Writer name: 'ASR Writer'
   Writer Id: {be000cbe-11fe-4426-9c58-531aa6355fc4}
   Writer Instance Id: {b4f5f3ac-8db5-47b3-a1d7-4b814baa1736}
   State: [7] Failed
   Last error: Timed out

Writer name: 'IIS Config Writer'
   Writer Id: {2a40fd15-dfca-4aa8-a654-1f8c654603f6}
   Writer Instance Id: {b92a194f-d6f8-4790-a9e8-d0646999c906}
   State: [1] Stable
   Last error: No error

Writer name: 'Dhcp Jet Writer'
   Writer Id: {be9ac81e-3619-421f-920f-4c6fea9e93ad}
   Writer Instance Id: {9afb2cbe-9db1-417c-9136-f4c0837b23eb}
   State: [1] Stable
   Last error: No error

Writer name: 'NTDS'
   Writer Id: {b2014c9e-8711-4c5c-a5a9-3cf384484757}
   Writer Instance Id: {dcb8e87a-6d3d-40b0-902f-89d30fbcdc3c}
   State: [1] Stable
   Last error: No error

Writer name: 'Shadow Copy Optimization Writer'
   Writer Id: {4dc3bdd4-ab48-4d07-adb0-3bee2926fd7f}
   Writer Instance Id: {e36a4855-b74b-4559-bc6e-b647d60e2e7e}
   State: [1] Stable
   Last error: No error

Writer name: 'Registry Writer'
   Writer Id: {afbab4a2-367d-4d15-a586-71dbb18f8485}
   Writer Instance Id: {571a08af-c095-49bb-a0fd-4a946d1287f6}
   State: [1] Stable
   Last error: No error

Writer name: 'BITS Writer'
   Writer Id: {4969d978-be47-48b0-b100-f328f07ac1e0}
   Writer Instance Id: {e3c59b08-dd43-4e6c-8dca-aee63da2a96c}
   State: [1] Stable
   Last error: No error

Writer name: 'WMI Writer'
   Writer Id: {a6ad56c2-b509-4e6c-bb19-49d8f43532f0}
   Writer Instance Id: {c9efc513-0372-4573-b3b0-9a6df3c2a4ea}
   State: [1] Stable
   Last error: No error

Writer name: 'COM+ REGDB Writer'
   Writer Id: {542da469-d3e1-473c-9f4f-7847f01fc64f}
   Writer Instance Id: {ef41c3e5-8fb8-4143-9884-d5447eba05f0}
   State: [1] Stable
   Last error: No error

3)

Provider name: 'Symantec Software VSS Provider'
   Provider type: Software
   Provider Id: {262b716e-bb23-41b5-aaef-e2c15e767167}
   Version: 1.0

Provider name: 'Microsoft Software Shadow Copy provider 1.0'
   Provider type: System
   Provider Id: {b5946137-7b9f-4925-af80-51abd60b20d5}
   Version: 1.0.0.7

4)

vssadmin 1.1 - Volume Shadow Copy Service administrative command-line tool
(C) Copyright 2001-2005 Microsoft Corp.

Contents of shadow copy set ID: {8aa91763-3b52-4da9-b67e-2d1cc87353c2}
   Contained 1 shadow copies at creation time: 03/09/2012 18:16:58
      Shadow Copy ID: {1be72785-1814-4cdc-a55a-6e29d02d6494}
         Original Volume: (C:)\\?\Volume{d001b522-1814-11e0-93b8-806e6f6e6963}\
         Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1
         Originating Machine: Foods-AD.foods.localdomain
         Service Machine: Foods-AD.foods.localdomain
         Provider: 'Microsoft Software Shadow Copy provider 1.0'
         Type: ClientAccessible
         Attributes: Persistent, Client-accessible, No auto release, No writers, Differential

Contents of shadow copy set ID: {0d88a1fd-a39c-4583-9573-b0903f34512e}
   Contained 1 shadow copies at creation time: 04/09/2012 07:00:10
      Shadow Copy ID: {82830c0f-83d9-4335-9a36-a4e29165dfaa}
         Original Volume: (C:)\\?\Volume{d001b522-1814-11e0-93b8-806e6f6e6963}\
         Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy2
         Originating Machine: Foods-AD.foods.localdomain
         Service Machine: Foods-AD.foods.localdomain
         Provider: 'Microsoft Software Shadow Copy provider 1.0'
         Type: ClientAccessible
         Attributes: Persistent, Client-accessible, No auto release, No writers, Differential

Contents of shadow copy set ID: {8ec559a7-5d6d-414e-bb9c-62542fb08466}
   Contained 1 shadow copies at creation time: 04/09/2012 12:00:29
      Shadow Copy ID: {71770b04-757a-43b2-87d1-c8992f660f72}
         Original Volume: (C:)\\?\Volume{d001b522-1814-11e0-93b8-806e6f6e6963}\
         Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy3
         Originating Machine: Foods-AD.foods.localdomain
         Service Machine: Foods-AD.foods.localdomain
         Provider: 'Microsoft Software Shadow Copy provider 1.0'
         Type: ClientAccessible
         Attributes: Persistent, Client-accessible, No auto release, No writers, Differential

Contents of shadow copy set ID: {f30c1900-3cfb-4eb0-97d9-ef5a46a0c0f8}
   Contained 1 shadow copies at creation time: 05/09/2012 07:00:04
      Shadow Copy ID: {f3b28eea-a0be-4acc-b4ab-aa1e4a89d3b1}
         Original Volume: (C:)\\?\Volume{d001b522-1814-11e0-93b8-806e6f6e6963}\
         Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy4
         Originating Machine: Foods-AD.foods.localdomain
         Service Machine: Foods-AD.foods.localdomain
         Provider: 'Microsoft Software Shadow Copy provider 1.0'
         Type: ClientAccessible
         Attributes: Persistent, Client-accessible, No auto release, No writers, Differential

Contents of shadow copy set ID: {5fffa732-db34-4741-a203-f663444e762e}
   Contained 1 shadow copies at creation time: 05/09/2012 12:00:33
      Shadow Copy ID: {43f0980f-3f63-4b11-999f-7b9f41acff87}
         Original Volume: (C:)\\?\Volume{d001b522-1814-11e0-93b8-806e6f6e6963}\
         Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy5
         Originating Machine: Foods-AD.foods.localdomain
         Service Machine: Foods-AD.foods.localdomain
         Provider: 'Microsoft Software Shadow Copy provider 1.0'
         Type: ClientAccessible
         Attributes: Persistent, Client-accessible, No auto release, No writers, Differential

Contents of shadow copy set ID: {dc209fcc-fdb7-463e-9d26-61618f6657fb}
   Contained 1 shadow copies at creation time: 06/09/2012 07:00:03
      Shadow Copy ID: {413c89ee-6287-4cbe-af39-c810a3cfc8e1}
         Original Volume: (C:)\\?\Volume{d001b522-1814-11e0-93b8-806e6f6e6963}\
         Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy30
         Originating Machine: Foods-AD.foods.localdomain
         Service Machine: Foods-AD.foods.localdomain
         Provider: 'Microsoft Software Shadow Copy provider 1.0'
         Type: ClientAccessible
         Attributes: Persistent, Client-accessible, No auto release, No writers, Differential

Contents of shadow copy set ID: {ee9bfcbe-4066-4488-a96c-319ff732cb2b}
   Contained 1 shadow copies at creation time: 06/09/2012 12:00:30
      Shadow Copy ID: {9bfaf619-efa1-4fc3-8a21-18bef8764113}
         Original Volume: (C:)\\?\Volume{d001b522-1814-11e0-93b8-806e6f6e6963}\
         Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy31
         Originating Machine: Foods-AD.foods.localdomain
         Service Machine: Foods-AD.foods.localdomain
         Provider: 'Microsoft Software Shadow Copy provider 1.0'
         Type: ClientAccessible
         Attributes: Persistent, Client-accessible, No auto release, No writers, Differential

Contents of shadow copy set ID: {d97c4300-56f2-41b4-9596-273600ab34e9}
   Contained 1 shadow copies at creation time: 07/09/2012 07:00:06
      Shadow Copy ID: {50e6fe47-04fb-495f-b8f0-f938f8532650}
         Original Volume: (C:)\\?\Volume{d001b522-1814-11e0-93b8-806e6f6e6963}\
         Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy33
         Originating Machine: Foods-AD.foods.localdomain
         Service Machine: Foods-AD.foods.localdomain
         Provider: 'Microsoft Software Shadow Copy provider 1.0'
         Type: ClientAccessible
         Attributes: Persistent, Client-accessible, No auto release, No writers, Differential

Contents of shadow copy set ID: {35af610d-cc97-4f5b-8669-98d02fd7eebe}
   Contained 1 shadow copies at creation time: 07/09/2012 12:00:32
      Shadow Copy ID: {80668e77-6359-4b2f-84b1-4b96037c10ba}
         Original Volume: (C:)\\?\Volume{d001b522-1814-11e0-93b8-806e6f6e6963}\
         Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy34
         Originating Machine: Foods-AD.foods.localdomain
         Service Machine: Foods-AD.foods.localdomain
         Provider: 'Microsoft Software Shadow Copy provider 1.0'
         Type: ClientAccessible
         Attributes: Persistent, Client-accessible, No auto release, No writers, Differential

Contents of shadow copy set ID: {fe91b6a8-b45c-4995-8291-eadb479e0da8}
   Contained 1 shadow copies at creation time: 10/09/2012 07:00:04
      Shadow Copy ID: {dddc2107-dc7b-470e-b591-39f61e04f882}
         Original Volume: (C:)\\?\Volume{d001b522-1814-11e0-93b8-806e6f6e6963}\
         Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy42
         Originating Machine: Foods-AD.foods.localdomain
         Service Machine: Foods-AD.foods.localdomain
         Provider: 'Microsoft Software Shadow Copy provider 1.0'
         Type: ClientAccessible
         Attributes: Persistent, Client-accessible, No auto release, No writers, Differential

Contents of shadow copy set ID: {bf62a752-fc15-4f8a-a2dd-39b9571876de}
   Contained 1 shadow copies at creation time: 10/09/2012 12:00:48
      Shadow Copy ID: {5f82a057-a73b-4452-ac91-22724a0c838a}
         Original Volume: (C:)\\?\Volume{d001b522-1814-11e0-93b8-806e6f6e6963}\
         Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy43
         Originating Machine: Foods-AD.foods.localdomain
         Service Machine: Foods-AD.foods.localdomain
         Provider: 'Microsoft Software Shadow Copy provider 1.0'
         Type: ClientAccessible
         Attributes: Persistent, Client-accessible, No auto release, No writers, Differential

Contents of shadow copy set ID: {ad7845a5-6605-4809-bd39-fc7cb9af7512}
   Contained 1 shadow copies at creation time: 11/09/2012 07:00:07
      Shadow Copy ID: {a4143839-17d6-46ad-b3b6-99372e896436}
         Original Volume: (C:)\\?\Volume{d001b522-1814-11e0-93b8-806e6f6e6963}\
         Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy45
         Originating Machine: Foods-AD.foods.localdomain
         Service Machine: Foods-AD.foods.localdomain
         Provider: 'Microsoft Software Shadow Copy provider 1.0'
         Type: ClientAccessible
         Attributes: Persistent, Client-accessible, No auto release, No writers, Differential

Contents of shadow copy set ID: {88b22515-00a3-40d7-b990-f0b01691688d}
   Contained 1 shadow copies at creation time: 11/09/2012 12:00:51
      Shadow Copy ID: {a1778924-d533-42c5-b6bb-f54c75bf80f6}
         Original Volume: (C:)\\?\Volume{d001b522-1814-11e0-93b8-806e6f6e6963}\
         Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy46
         Originating Machine: Foods-AD.foods.localdomain
         Service Machine: Foods-AD.foods.localdomain
         Provider: 'Microsoft Software Shadow Copy provider 1.0'
         Type: ClientAccessible
         Attributes: Persistent, Client-accessible, No auto release, No writers, Differential

Contents of shadow copy set ID: {87b3be49-8dfe-4545-8c85-d1280319f23d}
   Contained 1 shadow copies at creation time: 11/09/2012 19:00:03
      Shadow Copy ID: {276b58cf-e48c-4645-ba4a-47cb4c4975a1}
         Original Volume: (C:)\\?\Volume{d001b522-1814-11e0-93b8-806e6f6e6963}\
         Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy47
         Originating Machine: Foods-AD.foods.localdomain
         Service Machine: Foods-AD.foods.localdomain
         Provider: 'Microsoft Software Shadow Copy provider 1.0'
         Type: ClientAccessible
         Attributes: Persistent, Client-accessible, No auto release, No writers, Differential

Contents of shadow copy set ID: {5b105bc3-3779-4a31-a176-c6e27e395660}
   Contained 1 shadow copies at creation time: 26/05/2012 21:01:29
      Shadow Copy ID: {dcae6f44-63c1-4c1e-83e1-891edc6689ac}
         Original Volume: (G:)\\?\Volume{cd2e77d6-a59d-11e1-b2a9-78e7d17aa4cd}\
         Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy12
         Originating Machine: Foods-AD.foods.localdomain
         Service Machine: Foods-AD.foods.localdomain
         Provider: 'Microsoft Software Shadow Copy provider 1.0'
         Type: DataVolumeRollback
         Attributes: Persistent, No auto release, No writers, Differential

Contents of shadow copy set ID: {09e951a2-10aa-420c-a5ad-d50f3650df99}
   Contained 1 shadow copies at creation time: 27/05/2012 21:01:22
      Shadow Copy ID: {62f7d534-2640-402b-8bcc-6c9176a46794}
         Original Volume: (G:)\\?\Volume{cd2e77d6-a59d-11e1-b2a9-78e7d17aa4cd}\
         Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy13
         Originating Machine: Foods-AD.foods.localdomain
         Service Machine: Foods-AD.foods.localdomain
         Provider: 'Microsoft Software Shadow Copy provider 1.0'
         Type: DataVolumeRollback
         Attributes: Persistent, No auto release, No writers, Differential

Contents of shadow copy set ID: {16bd994c-94ad-4d31-ac89-354bbdc09efb}
   Contained 1 shadow copies at creation time: 28/05/2012 21:03:47
      Shadow Copy ID: {f7a45736-a37e-458a-ac3d-f7a637dcec29}
         Original Volume: (G:)\\?\Volume{cd2e77d6-a59d-11e1-b2a9-78e7d17aa4cd}\
         Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy14
         Originating Machine: Foods-AD.foods.localdomain
         Service Machine: Foods-AD.foods.localdomain
         Provider: 'Microsoft Software Shadow Copy provider 1.0'
         Type: DataVolumeRollback
         Attributes: Persistent, No auto release, No writers, Differential

Contents of shadow copy set ID: {4967d12a-6678-41b0-9984-e2262338f057}
   Contained 1 shadow copies at creation time: 29/05/2012 21:01:40
      Shadow Copy ID: {e2166ac7-3b8b-41f2-bb27-c78fbaeb68e9}
         Original Volume: (G:)\\?\Volume{cd2e77d6-a59d-11e1-b2a9-78e7d17aa4cd}\
         Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy15
         Originating Machine: Foods-AD.foods.localdomain
         Service Machine: Foods-AD.foods.localdomain
         Provider: 'Microsoft Software Shadow Copy provider 1.0'
         Type: DataVolumeRollback
         Attributes: Persistent, No auto release, No writers, Differential

Contents of shadow copy set ID: {3c25bb8e-2eff-4b71-9210-1b2bbff94256}
   Contained 1 shadow copies at creation time: 30/05/2012 21:01:28
      Shadow Copy ID: {20def5c0-a411-43f8-afb4-11f0a99fefc8}
         Original Volume: (G:)\\?\Volume{cd2e77d6-a59d-11e1-b2a9-78e7d17aa4cd}\
         Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy16
         Originating Machine: Foods-AD.foods.localdomain
         Service Machine: Foods-AD.foods.localdomain
         Provider: 'Microsoft Software Shadow Copy provider 1.0'
         Type: DataVolumeRollback
         Attributes: Persistent, No auto release, No writers, Differential

Contents of shadow copy set ID: {f99ea810-163e-4926-a4ae-35017c54bad7}
   Contained 1 shadow copies at creation time: 31/05/2012 21:01:34
      Shadow Copy ID: {2f5174e9-a5cc-43a5-94a4-00713cbb60e0}
         Original Volume: (G:)\\?\Volume{cd2e77d6-a59d-11e1-b2a9-78e7d17aa4cd}\
         Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy17
         Originating Machine: Foods-AD.foods.localdomain
         Service Machine: Foods-AD.foods.localdomain
         Provider: 'Microsoft Software Shadow Copy provider 1.0'
         Type: DataVolumeRollback
         Attributes: Persistent, No auto release, No writers, Differential

Contents of shadow copy set ID: {779ad3ed-a5d6-4563-81bc-4810f7ec3487}
   Contained 1 shadow copies at creation time: 01/06/2012 21:04:24
      Shadow Copy ID: {ee5cd5a2-f9a2-4319-8efe-97a30df66452}
         Original Volume: (G:)\\?\Volume{cd2e77d6-a59d-11e1-b2a9-78e7d17aa4cd}\
         Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy19
         Originating Machine: Foods-AD.foods.localdomain
         Service Machine: Foods-AD.foods.localdomain
         Provider: 'Microsoft Software Shadow Copy provider 1.0'
         Type: DataVolumeRollback
         Attributes: Persistent, No auto release, No writers, Differential

Contents of shadow copy set ID: {02c3d3a6-53d4-4e48-a8bb-8c2f4fa97fd1}
   Contained 1 shadow copies at creation time: 02/06/2012 21:01:17
      Shadow Copy ID: {db985833-2254-4067-ad6e-7f425cba3a1d}
         Original Volume: (G:)\\?\Volume{cd2e77d6-a59d-11e1-b2a9-78e7d17aa4cd}\
         Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy20
         Originating Machine: Foods-AD.foods.localdomain
         Service Machine: Foods-AD.foods.localdomain
         Provider: 'Microsoft Software Shadow Copy provider 1.0'
         Type: DataVolumeRollback
         Attributes: Persistent, No auto release, No writers, Differential

Contents of shadow copy set ID: {f40c8730-ee44-4af5-92ec-89c18213b465}
   Contained 1 shadow copies at creation time: 03/06/2012 21:01:25
      Shadow Copy ID: {a7aa3cdc-6ab9-405d-a9d2-abfd40a991cf}
         Original Volume: (G:)\\?\Volume{cd2e77d6-a59d-11e1-b2a9-78e7d17aa4cd}\
         Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy21
         Originating Machine: Foods-AD.foods.localdomain
         Service Machine: Foods-AD.foods.localdomain
         Provider: 'Microsoft Software Shadow Copy provider 1.0'
         Type: DataVolumeRollback
         Attributes: Persistent, No auto release, No writers, Differential

Contents of shadow copy set ID: {df4f461b-7aeb-480f-b9c8-89b026dfd507}
   Contained 1 shadow copies at creation time: 04/06/2012 21:01:41
      Shadow Copy ID: {5daf892d-2fe1-4119-adab-0f06c4bc1731}
         Original Volume: (G:)\\?\Volume{cd2e77d6-a59d-11e1-b2a9-78e7d17aa4cd}\
         Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy23
         Originating Machine: Foods-AD.foods.localdomain
         Service Machine: Foods-AD.foods.localdomain
         Provider: 'Microsoft Software Shadow Copy provider 1.0'
         Type: DataVolumeRollback
         Attributes: Persistent, No auto release, No writers, Differential

Contents of shadow copy set ID: {ed21956c-6e1f-42bb-bcee-de65068bf6d8}
   Contained 1 shadow copies at creation time: 05/06/2012 21:01:42
      Shadow Copy ID: {0940e206-3365-4636-b176-131fe6468602}
         Original Volume: (G:)\\?\Volume{cd2e77d6-a59d-11e1-b2a9-78e7d17aa4cd}\
         Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy24
         Originating Machine: Foods-AD.foods.localdomain
         Service Machine: Foods-AD.foods.localdomain
         Provider: 'Microsoft Software Shadow Copy provider 1.0'
         Type: DataVolumeRollback
         Attributes: Persistent, No auto release, No writers, Differential

Contents of shadow copy set ID: {71894215-c80b-49da-b298-31869f3ff8d7}
   Contained 1 shadow copies at creation time: 06/06/2012 21:01:44
      Shadow Copy ID: {5d807187-216c-488a-87a6-2982031f9a8f}
         Original Volume: (G:)\\?\Volume{cd2e77d6-a59d-11e1-b2a9-78e7d17aa4cd}\
         Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy25
         Originating Machine: Foods-AD.foods.localdomain
         Service Machine: Foods-AD.foods.localdomain
         Provider: 'Microsoft Software Shadow Copy provider 1.0'
         Type: DataVolumeRollback
         Attributes: Persistent, No auto release, No writers, Differential

Contents of shadow copy set ID: {c1479934-d609-404d-8d99-767e7364e858}
   Contained 1 shadow copies at creation time: 07/06/2012 21:01:41
      Shadow Copy ID: {20ec0a48-5eaa-4e1b-853b-ba95d7462b52}
         Original Volume: (G:)\\?\Volume{cd2e77d6-a59d-11e1-b2a9-78e7d17aa4cd}\
         Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy26
         Originating Machine: Foods-AD.foods.localdomain
         Service Machine: Foods-AD.foods.localdomain
         Provider: 'Microsoft Software Shadow Copy provider 1.0'
         Type: DataVolumeRollback
         Attributes: Persistent, No auto release, No writers, Differential

Contents of shadow copy set ID: {bb57bfc1-c928-43d0-91d9-7cfd342ced84}
   Contained 1 shadow copies at creation time: 08/06/2012 21:01:44
      Shadow Copy ID: {3d077e71-dd02-4eb4-b363-c14a7e62643a}
         Original Volume: (G:)\\?\Volume{cd2e77d6-a59d-11e1-b2a9-78e7d17aa4cd}\
         Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy27
         Originating Machine: Foods-AD.foods.localdomain
         Service Machine: Foods-AD.foods.localdomain
         Provider: 'Microsoft Software Shadow Copy provider 1.0'
         Type: DataVolumeRollback
         Attributes: Persistent, No auto release, No writers, Differential

Contents of shadow copy set ID: {966be68e-0283-470e-8336-e5bb79f60a71}
   Contained 1 shadow copies at creation time: 09/06/2012 21:01:29
      Shadow Copy ID: {69282b46-9a86-4d7e-90c8-fa3f7c5ca7b7}
         Original Volume: (G:)\\?\Volume{cd2e77d6-a59d-11e1-b2a9-78e7d17aa4cd}\
         Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy28
         Originating Machine: Foods-AD.foods.localdomain
         Service Machine: Foods-AD.foods.localdomain
         Provider: 'Microsoft Software Shadow Copy provider 1.0'
         Type: DataVolumeRollback
         Attributes: Persistent, No auto release, No writers, Differential

Contents of shadow copy set ID: {87385bfb-44ac-4028-bb2d-4d0dba56e3b6}
   Contained 1 shadow copies at creation time: 04/09/2012 23:00:10
      Shadow Copy ID: {f4471aca-39a8-47af-abae-d1c0c4ab208a}
         Original Volume: (D:)\\?\Volume{d001b523-1814-11e0-93b8-806e6f6e6963}\
         Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy11
         Originating Machine: Foods-AD.foods.localdomain
         Service Machine: Foods-AD.foods.localdomain
         Provider: 'Microsoft Software Shadow Copy provider 1.0'
         Type: ClientAccessible
         Attributes: Persistent, Client-accessible, No auto release, No writers, Differential

Contents of shadow copy set ID: {33bc485c-c166-4f61-bc42-0952e441d013}
   Contained 1 shadow copies at creation time: 05/09/2012 23:00:16
      Shadow Copy ID: {90fc2a05-546f-4723-aa67-30e9d717dd96}
         Original Volume: (D:)\\?\Volume{d001b523-1814-11e0-93b8-806e6f6e6963}\
         Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy29
         Originating Machine: Foods-AD.foods.localdomain
         Service Machine: Foods-AD.foods.localdomain
         Provider: 'Microsoft Software Shadow Copy provider 1.0'
         Type: ClientAccessible
         Attributes: Persistent, Client-accessible, No auto release, No writers, Differential

Contents of shadow copy set ID: {7fab084b-b457-4c51-bf74-e3fde613ea1f}
   Contained 1 shadow copies at creation time: 06/09/2012 23:00:08
      Shadow Copy ID: {06137913-7378-43ce-afd1-fee7be592333}
         Original Volume: (D:)\\?\Volume{d001b523-1814-11e0-93b8-806e6f6e6963}\
         Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy32
         Originating Machine: Foods-AD.foods.localdomain
         Service Machine: Foods-AD.foods.localdomain
         Provider: 'Microsoft Software Shadow Copy provider 1.0'
         Type: ClientAccessible
         Attributes: Persistent, Client-accessible, No auto release, No writers, Differential

Contents of shadow copy set ID: {3ac4ad24-fd93-4b46-947d-88bd4919106b}
   Contained 1 shadow copies at creation time: 07/09/2012 23:00:10
      Shadow Copy ID: {6a2e5fcb-a52c-4d05-8d93-c28de7437652}
         Original Volume: (D:)\\?\Volume{d001b523-1814-11e0-93b8-806e6f6e6963}\
         Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy35
         Originating Machine: Foods-AD.foods.localdomain
         Service Machine: Foods-AD.foods.localdomain
         Provider: 'Microsoft Software Shadow Copy provider 1.0'
         Type: ClientAccessible
         Attributes: Persistent, Client-accessible, No auto release, No writers, Differential

Contents of shadow copy set ID: {1a4eca6f-ca5c-42b7-8a8a-05127f7a7141}
   Contained 1 shadow copies at creation time: 08/09/2012 23:00:05
      Shadow Copy ID: {ac6fd47b-a368-483c-993a-62116e07a53e}
         Original Volume: (D:)\\?\Volume{d001b523-1814-11e0-93b8-806e6f6e6963}\
         Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy38
         Originating Machine: Foods-AD.foods.localdomain
         Service Machine: Foods-AD.foods.localdomain
         Provider: 'Microsoft Software Shadow Copy provider 1.0'
         Type: ClientAccessible
         Attributes: Persistent, Client-accessible, No auto release, No writers, Differential

Contents of shadow copy set ID: {a5497093-0db1-4ae7-87ae-609dbb05d429}
   Contained 1 shadow copies at creation time: 09/09/2012 23:00:33
      Shadow Copy ID: {5941fa1b-c739-46ba-a804-965b04ce483c}
         Original Volume: (D:)\\?\Volume{d001b523-1814-11e0-93b8-806e6f6e6963}\
         Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy41
         Originating Machine: Foods-AD.foods.localdomain
         Service Machine: Foods-AD.foods.localdomain
         Provider: 'Microsoft Software Shadow Copy provider 1.0'
         Type: ClientAccessible
         Attributes: Persistent, Client-accessible, No auto release, No writers, Differential

Contents of shadow copy set ID: {9f7585be-b141-4de6-bcf4-d9f91098d45f}
   Contained 1 shadow copies at creation time: 10/09/2012 23:00:10
      Shadow Copy ID: {37fef126-08ab-49cb-9401-bcd88bb509c0}
         Original Volume: (D:)\\?\Volume{d001b523-1814-11e0-93b8-806e6f6e6963}\
         Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy44
         Originating Machine: Foods-AD.foods.localdomain
         Service Machine: Foods-AD.foods.localdomain
         Provider: 'Microsoft Software Shadow Copy provider 1.0'
         Type: ClientAccessible
         Attributes: Persistent, Client-accessible, No auto release, No writers, Differential

Contents of shadow copy set ID: {5628e411-81d1-401f-b3be-06fb4984574c}
   Contained 1 shadow copies at creation time: 11/09/2012 23:00:11
      Shadow Copy ID: {f23f6ef6-e00d-48d0-91d9-3167258124f1}
         Original Volume: (D:)\\?\Volume{d001b523-1814-11e0-93b8-806e6f6e6963}\
         Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy48
         Originating Machine: Foods-AD.foods.localdomain
         Service Machine: Foods-AD.foods.localdomain
         Provider: 'Microsoft Software Shadow Copy provider 1.0'
         Type: ClientAccessible
         Attributes: Persistent, Client-accessible, No auto release, No writers, Differential

5)

Shadow Copy Storage association
   For volume: (C:)\\?\Volume{d001b522-1814-11e0-93b8-806e6f6e6963}\
   Shadow Copy Storage volume: (C:)\\?\Volume{d001b522-1814-11e0-93b8-806e6f6e69
63}\
   Used Shadow Copy Storage space: 6.9 GB (7%)
   Allocated Shadow Copy Storage space: 7.28 GB (7%)
   Maximum Shadow Copy Storage space: 9.766 GB (9%)

Shadow Copy Storage association
   For volume: (G:)\\?\Volume{cd2e77d6-a59d-11e1-b2a9-78e7d17aa4cd}\
   Shadow Copy Storage volume: (G:)\\?\Volume{cd2e77d6-a59d-11e1-b2a9-78e7d17aa4
cd}\
   Used Shadow Copy Storage space: 760.031 MB (0%)
   Allocated Shadow Copy Storage space: 3.564 GB (0%)
   Maximum Shadow Copy Storage space: UNBOUNDED (-606011960%)

Shadow Copy Storage association
   For volume: (D:)\\?\Volume{d001b523-1814-11e0-93b8-806e6f6e6963}\
   Shadow Copy Storage volume: (D:)\\?\Volume{d001b523-1814-11e0-93b8-806e6f6e69
63}\
   Used Shadow Copy Storage space: 34.277 GB (9%)
   Allocated Shadow Copy Storage space: 34.58 GB (9%)
   Maximum Shadow Copy Storage space: 36.807 GB (9%)

6)

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS
    DisplayName    REG_SZ    @%systemroot%\system32\vssvc.exe,-102
    ImagePath    REG_EXPAND_SZ    %systemroot%\system32\vssvc.exe
    Description    REG_SZ    @%systemroot%\system32\vssvc.exe,-101
    ObjectName    REG_SZ    LocalSystem
    ErrorControl    REG_DWORD    0x1
    Start    REG_DWORD    0x3
    Type    REG_DWORD    0x10
    DependOnService    REG_MULTI_SZ    RPCSS
    ServiceSidType    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS\Diag
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS\Providers
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS\Settings
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS\VssAccessControl

 

7)

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS\Providers\{262b716e-bb2
3-41b5-aaef-e2c15e767167}
    (Default)    REG_SZ    Symantec Software VSS Provider
    Type    REG_DWORD    0x2
    Version    REG_SZ    1.0
    VersionId    REG_SZ    {312524e0-c869-46ce-849b-7d99a24257cd}

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS\Providers\{262b716e-bb2
3-41b5-aaef-e2c15e767167}\CLSID
    (Default)    REG_SZ    {790f2886-9889-4c99-8ef5-531add05d044}

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS\Providers\{b5946137-7b9
f-4925-af80-51abd60b20d5}
    (Default)    REG_SZ    Microsoft Software Shadow Copy provider 1.0
    Type    REG_DWORD    0x1
    Version    REG_SZ    1.0.0.7
    VersionId    REG_SZ    {00000001-0000-0000-0007-000000000001}

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS\Providers\{b5946137-7b9
f-4925-af80-51abd60b20d5}\CLSID
    (Default)    REG_SZ    {65EE1DBA-8FF4-4a58-AC1C-3470EE2F376A}

 

8)

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS\Settings
    HotBlocksPreCopyPercentage    REG_DWORD    0x0
    FreeSpacePreCopyPercentage    REG_DWORD    0x0
    MSDEVersionChecking    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS\Settings\WritersBlockin
gRevert
    {2707761B-2324-473D-88EB-EB007A359533}    REG_SZ    DFS-R Writer
    {D76F5A28-3092-4589-BA48-2958FB88CE29}    REG_SZ    FRS Writer
    {B2014C9E-8711-4C5C-A5A9-3CF384484757}    REG_SZ    AD Writer
    {DD846AAA-A1B6-42a8-AAF8-03DCB6114BFD}    REG_SZ    ADAM Writer
    TornComponentsBlockRevert    REG_DWORD    0x1

 

9)

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS\VssAccessControl
    NT Authority\NetworkService    REG_DWORD    0x1

10)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP
    LastIndex    REG_DWORD    0x15c

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP\Clients
    {1D6B8E63-E68B-4DA2-900F-6017B4B6E1A0}    REG_MULTI_SZ    \\?\Volume{d001b52
3-1814-11e0-93b8-806e6f6e6963}\:New Volume (D%3A)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP\Leases

 

11)

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MountMgr
    DisplayName    REG_SZ    @%SystemRoot%\system32\drivers\mountmgr.sys,-100
    Group    REG_SZ    System Bus Extender
    ImagePath    REG_EXPAND_SZ    System32\drivers\mountmgr.sys
    Description    REG_SZ    @%SystemRoot%\system32\drivers\mountmgr.sys,-101
    ErrorControl    REG_DWORD    0x3
    Start    REG_DWORD    0x0
    Type    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MountMgr\Enum
    0    REG_SZ    Root\LEGACY_MOUNTMGR\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

 

12)

C:\Users\Administrator>REG QUERY "HKLM\SYSTEM\CurrentControlSet\Services\TrueCry
pt" /s
ERROR: The system was unable to find the specified registry key or value.

13)

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\control\hivelist
    \REGISTRY\MACHINE\HARDWARE    REG_SZ
    \REGISTRY\MACHINE\SOFTWARE    REG_SZ    \Device\HarddiskVolume1\Windows\Syst
em32\config\SOFTWARE
    \REGISTRY\MACHINE\SYSTEM    REG_SZ    \Device\HarddiskVolume1\Windows\System
32\config\SYSTEM
    \REGISTRY\USER\.DEFAULT    REG_SZ    \Device\HarddiskVolume1\Windows\System3
2\config\DEFAULT
    \REGISTRY\MACHINE\SECURITY    REG_SZ    \Device\HarddiskVolume1\Windows\Syst
em32\config\SECURITY
    \REGISTRY\MACHINE\SAM    REG_SZ    \Device\HarddiskVolume1\Windows\System32\
config\SAM
    \REGISTRY\USER\S-1-5-20    REG_SZ    \Device\HarddiskVolume1\Windows\Service
Profiles\NetworkService\NTUSER.DAT
    \REGISTRY\USER\S-1-5-19    REG_SZ    \Device\HarddiskVolume1\Windows\Service
Profiles\LocalService\NTUSER.DAT
    \Registry\User\S-1-5-21-742944032-1610741233-1441368438-1301    REG_SZ    \D
evice\HarddiskVolume1\Users\symantec\NTUSER.DAT
    \Registry\User\S-1-5-21-742944032-1610741233-1441368438-1301_Classes    REG_
SZ    \Device\HarddiskVolume1\Users\symantec\AppData\Local\Microsoft\Windows\Usr
Class.dat
    \Registry\User\S-1-5-21-742944032-1610741233-1441368438-500    REG_SZ    \De
vice\HarddiskVolume1\Users\Administrator\NTUSER.DAT
    \Registry\User\S-1-5-21-742944032-1610741233-1441368438-500_Classes    REG_S
Z    \Device\HarddiskVolume1\Users\Administrator\AppData\Local\Microsoft\Windows
\UsrClass.dat
    \REGISTRY\MACHINE\BCD00000000    REG_SZ    \Device\HarddiskVolume1\boot\bcd
    \REGISTRY\MACHINE\COMPONENTS    REG_SZ    \Device\HarddiskVolume1\Windows\Sy
stem32\config\COMPONENTS

14)

Microsoft Windows [Version 6.1.7600]

15)

Windows Boot Manager
--------------------
identifier              {bootmgr}
device                  partition=C:
description             Windows Boot Manager
locale                  en-US
inherit                 {globalsettings}
default                 {current}
resumeobject            {7ca2709f-83f7-11de-b3cd-b19e512299d2}
displayorder            {current}
                        {7619dcc9-fafe-11d9-b411-000476eba25f}
toolsdisplayorder       {memdiag}
timeout                 30

Windows Boot Loader
-------------------
identifier              {current}
device                  partition=C:
path                    \Windows\system32\winload.exe
description             Windows Server 2008 R2
locale                  en-US
inherit                 {bootloadersettings}
recoverysequence        {7ca270a1-83f7-11de-b3cd-b19e512299d2}
recoveryenabled         Yes
osdevice                partition=C:
systemroot              \Windows
resumeobject            {7ca2709f-83f7-11de-b3cd-b19e512299d2}
nx                      OptOut
hypervisorlaunchtype    Auto

Windows Boot Loader
-------------------
identifier              {7619dcc9-fafe-11d9-b411-000476eba25f}
device                  ramdisk=[boot]\sources\boot.wim,{7619dcc8-fafe-11d9-b411
-000476eba25f}
path                    \windows\system32\boot\winload.exe
description             Windows Setup
locale                  en-US
inherit                 {bootloadersettings}
osdevice                ramdisk=[boot]\sources\boot.wim,{7619dcc8-fafe-11d9-b411
-000476eba25f}
systemroot              \windows
detecthal               Yes
winpe                   Yes
ems                     Yes

 

16)

\\?\Volume{d001b522-1814-11e0-93b8-806e6f6e6963}\
    C:\

\\?\Volume{cd2e77d6-a59d-11e1-b2a9-78e7d17aa4cd}\
    G:\

\\?\Volume{0e8231f1-c124-11e1-95bb-78e7d17aa4cd}\
    H:\

\\?\Volume{d001b523-1814-11e0-93b8-806e6f6e6963}\
    D:\

\\?\Volume{d001b530-1814-11e0-93b8-806e6f6e6963}\
    F:\

\\?\Volume{d001b526-1814-11e0-93b8-806e6f6e6963}\
    E:\

 

Physical machine

 

 

 

marcusolini's picture

Hi.  Thank you for collecting the VSS diagnostic information.  From a quick review, barring the current issue, the VSS subsystem seems stable since automatic system related snapshots are present.  It appears that the issue might be caused by the Shadow Storage user-defined maximum size limit configured for the D: volume.   When able, please review and follow the below self-help diagnostics.

Review the current Shadow Storage settings for the D: volume by executing Step (20).  Confirm the native snapshot failure of the D: volume by executing Step (21).  Increase the Shadow Storage settings for the D: volume by executing Step (22).  Determine if increasing the Shadow Storage setting for the D: volume has solved the issue by executing Step (23).   Consider deleting the existing D: volume snapshots by executing step (24).   If the issue still exists, then please review and report any related errors in the System Event Log from the source “volsnap” and in the Application Event Log from the source “VSS”.  Please let me know the outcome.  Thank you.

(20) C:\>VSSADMIN LIST SHADOWSTORAGE /FOR=D:

(21) C:\>VSSADMIN CREATE SHADOW /FOR=D:

(22) C:\>VSSADMIN RESIZE SHADOWSTORAGE /FOR=D: /ON=D: /MAXSIZE=20%

(23) C:\>VSSADMIN CREATE SHADOW /FOR=D:

 

(24) C:\>VSSADMIN DELETE SHADOWS /FOR=D:

ncoowar's picture

marcusolini

i did 20-23. i will restart the server tonight as its a file server too and will post result tomorrow.

ncoowar's picture

when i restarted the server and checked the event log i got this message for vss:

 

 

RegOpenKeyExW(-2147483646,SYSTEM\CurrentControlSet\Services\VSS\Diag,...)

 

      0x80070005, Access is denied.

 

      Operation: Initializing Writer Context: Writer Class Id: {e8132975-6f93-4464-a53e-1050253ae220} Writer Name: System Writer Writer Instance ID: {1f4324ed-086a-4d63-9cc0-606a3d6597d5}

 

      2D20436F64653A20524547524547534330303030303135362D2043616C6C3A20524547524547534330303030303132392D205049443A202030303030303534302D205449443A202030303030313736302D20434D443A2020433A5C57696E646F77735C73797374656D33325C737663686F73742E657865202D6B204E6574776F726B53657276696365202020202020202D20557365723A204E616D653A204E5420415554484F524954595C4E4554574F524B20534552564943452C205349443A532D312D352D3230

 

marcusolini's picture

Hi.  With the assumption that the backup failure is still occurring for the D: volume, please post the Backup Exec Job Log that contains the recent failure.  Also, please post the results of steps (25) and (26) below.  Thank you.

(25) C:\>VSSADMIN LIST SHADOWSTORAGE /FOR=D:

(26) C:\>VSSADMIN CREATE SHADOW /FOR=D:

ncoowar's picture

C:\Users\Administrator>VSSADMIN LIST SHADOWSTORAGE /FOR=D:
vssadmin 1.1 - Volume Shadow Copy Service administrative command-line tool
(C) Copyright 2001-2005 Microsoft Corp.

Shadow Copy Storage association
   For volume: (D:)\\?\Volume{d001b523-1814-11e0-93b8-806e6f6e6963}\
   Shadow Copy Storage volume: (D:)\\?\Volume{d001b523-1814-11e0-93b8-806e6f6e69
63}\
   Used Shadow Copy Storage space: 53.636 GB (14%)
   Allocated Shadow Copy Storage space: 53.99 GB (14%)
   Maximum Shadow Copy Storage space: 73.614 GB (20%)

C:\Users\Administrator>VSSADMIN CREATE SHADOW /FOR=D:
vssadmin 1.1 - Volume Shadow Copy Service administrative command-line tool
(C) Copyright 2001-2005 Microsoft Corp.

Successfully created shadow copy for 'D:\'
    Shadow Copy ID: {4bab3f57-0936-42be-8f7e-a188cc898114}
    Shadow Copy Volume Name: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy62

marcusolini's picture

Hi.   Thank you for the VSS diagnostic information.  Please confirm if the Backup Exec backup job for the D: volume is failing or is successful with the modifications to the VSS Shadow Storage for the D: volume.  If failing, please attach the corresponding backup job log for review.  Thank you.

ncoowar's picture

i am still getting the exception about vss snapshot not being done.

marcusolini's picture

Hi.  Thank you for letting me know.  When able please attach the most recent and corresponding backup job log for review.  The most likely next step is to gather corresponding Backup Exec and VSS debug logs.  Thank you.

ncoowar's picture

Please see attached  the last logs.

I restarted the server several time and checked the services but i can figure the issue.

even if the backup is completing with an exception, will i be able to do a restore?

AttachmentSize
Job Log BEX_FOODS-AD_00237_xml.rar 4.58 KB
marcusolini's picture

Hi.  The Backup Exec job log provided contains a VSS snapshot failure for a different device and volume.   This snapshot failure relates to a SQL Server snapshot failure on the C: volume.  For the SQL Server backup, since a snapshot failure occurred the Backup Exec SQL Agent automatically performed a fallback to SQL VDI streaming methodologies, which resulted in a successful backup.  The snapshot exception is reported since the Advanced Open File Open is enabled to use snapshot technology.  As a short-term solution, this option can be disabled to alleviate the exception.  Before investigating the SQL Server snapshot failure, please first confirm if the original VSS snapshot failure for the D: volume is still occurring or not with the modifications to the VSS Shadow Storage for the D: volume.  If so, please attach the corresponding D: volume backup job log for review.  Thank you.

ncoowar's picture

here is the d: drive log from Backup exec

AttachmentSize
Job Log BEX_FOODS-AD_00251_xml.rar 21.72 KB
marcusolini's picture

Hi.  Thank you for the Backup Exec job log.  Since the failure is still a mystery more detailed information is needed.  When able, please collect a Backup Exec debug log and VSS debug log using procedures that you are already familiar with or using the below procedures.  When complete, please attach the files zipped to this post for review.  Thank you.

Backup Exec Admin Console…

(27) Click the icon near the top left corner of application window (Alt+a).

(28) Select ‘Technical Support’.

(29) Click ‘Collect debug output’.

 

Backup Exec Debug Monitor (start)…

(30) Select ‘Job Engine, RAWS, Agent Browser’ from the ‘Capture’ section (Alt+j).

(31) Select ‘Capture to file’ from the ‘Capture to file:’ section (Alt+u).

 

VSS Debug Logging (start) from a Windows Command Prompt…

(32) C:\> LOGMAN START vsstrace -o c:\vsstrace.etl -ets -p {9138500e-3648-4edb-aa4c-859e9f7b7c38} 0xFFFF 255

Note, an alternate output location can be specified (-o).

 

Backup Exec Admin Console (run job)…

(33) Run the backup job for the D: volume that is experiencing the exception: V-79-10000-11226 - VSS Snapshot error. The Microsoft Volume Shadow Copy Service (VSS) snapshot technology selected returned: "Unexpected provider error".

(34) Wait for the backup job to complete.

 

Backup Exec Debug Monitor (stop)…

(35) Select from the top menu ‘Debug’ (Alt+d).

(36) Select ‘Open Log’ and save the debug log output  (Alt+n).

(37) Select ‘Stop capturing debug output’ (Ctrl+E).

 

VSS Debug Logging (stop) from a Windows Command Prompt…

(38) C:\> LOGMAN STOP vsstrace -ETS

 

Note, the procedures are based on the affected system being Windows 2008 R2 and a Backup Exec 2012 Media Server.

ncoowar's picture

Hi,  please find attached the logs as requested.

AttachmentSize
FOODS-AD-SGMon.rar 640.96 KB
marcusolini's picture

Hi.  Thank you for the Backup Exec debug log.  Without the requested corresponding VSS debug log I am only able to speculate that there appears to be a snapshot interoperability issue with the Symantec Software VSS Provider.  A possible manual workaround is to modify the failing backup job for the D: volume to specifically use the Microsoft System VSS Shadow Copy Software Provider and to disable checkpoint restart.  When able, please execute steps (39) to (46) and report the outcome.  Thank you.

Backup Exec Admin Console…

(39) Select and Edit the backup Job for the D: volume.

(40) From ‘Backup Properties’ Edit the ‘Backup’ stage.

(41) From ‘Backup Options’ select ‘Advanced Open File’.

(42) From ‘Snapshot’ clear checkbox  ‘Enable checkpoint restart’.

(43) From ‘Snapshot configuration’ choose ‘Microsoft Volume Shadow Copy Server…’.

(44) From ‘Snapshot provider’ select ‘System - Use the Microsoft Shadow Copy Provider’.

(45) Save the changes by clicking ‘OK’ where appropriate.

(46) Run the backup job for the D: volume.