VSS errors logged ID 20 & ID 8 - vssadmin reports no writers

[SBS 2003 Premium SP1]

We've had problems with VSS for a couple of weeks now. Initially, the VSS
error reported was ID no 6013, around 50+ occurances in the first few
seconds of a scheduled NTBackup - the backup subsequently worked without a
problem (or without error - the shadow copy service appeared to function
correctly).

The company previously used Backup Exec, and after installing a new Dell PE
2850 with a fresh install of SBS2003 PE SP1, they were quite happy using
NTBackup (I had used it at my previous location without a problem and always
thought of BE as overkill). But, as the VSS errors weren't going away (even
after obtaining and applying hotfix 915331), I made the decision to install
BE (the 60-day trial copy) to see if that would get rid of the problem).


Initially, it worked OK - the VSS errors disappeared, but BE didn't seem to
be backing up open-files (even though the option was installed and
selected).

After a short while it stated to becom a problem, and BE was hanging on
'snapshot processing', so I removed it from the system to go back to a
system I know worked - NTBackup.

My first manual test backup failed - NTBackup hung on the snapshot creation,
then, after some considerable time, came back with the following error:

Volume shadow copy creation: Attempt 1.
Timeout before function completed

Error returned while creating the volume shadow copy:0xffffffff.

Error returned while creating the volume shadow copy:ffffffff
Aborting Backup.

Obviously, there was something amiss.

The following errors were also logged in the application event log:

----------------------------------------------------------------

Event Type: Error
Event Source: VSS
Event Category: None
Event ID: 20
Date: 05/08/2006
Time: 11:56:20
User: N/A
Computer: ********
Description:
Volume Shadow Copy Service error: A critical component required by the
Volume Shadow Copy service is not registered. This might happened if an
error occurred during Windows setup or during installation of a Shadow Copy
provider. The error returned from CoCreateInstance on class with CLSID
{faf53cc4-bd73-4e36-83f1-2b23f46e513e} and Name VSSEvent is [0x80040154].

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 2d 20 43 6f 64 65 3a 20 - Code:
0008: 42 55 45 43 58 4d 4c 43 BUECXMLC
0010: 30 30 30 30 33 32 38 31 00003281
0018: 2d 20 43 61 6c 6c 3a 20 - Call:
0020: 42 55 45 43 58 4d 4c 43 BUECXMLC
0028: 30 30 30 30 37 30 39 36 00007096
0030: 2d 20 50 49 44 3a 20 20 - PID:
0038: 30 30 30 30 37 30 34 30 00007040
0040: 2d 20 54 49 44 3a 20 20 - TID:
0048: 30 30 30 30 34 32 36 30 00004260
0050: 2d 20 43 4d 44 3a 20 20 - CMD:
0058: 76 73 73 61 64 6d 69 6e vssadmin
0060: 20 6c 69 73 74 20 77 72 list wr
0068: 69 74 65 72 73 20 20 20 iters
0070: 2d 20 55 73 65 72 3a 20 - User:
0078: 99 99 99 99 99 99 99 99 xxxxxxxx
0080: 99 99 5c 61 64 6d 69 6e xx\admin
0088: 69 73 74 72 61 74 6f 72 istrator
0090: 2d 20 53 69 64 3a 20 20 - Sid:
0098: 53 2d 31 2d 35 2d 32 31 S-1-5-21
00a0: 2d 31 33 33 34 30 36 39 -1334069
00a8: 31 34 30 2d 32 38 31 31 140-2811
00b0: 34 32 31 32 31 35 2d 32 421215-2
00b8: 36 30 30 34 35 33 34 30 60045340
00c0: 32 2d 35 30 30 20 20 20 2-500

----------------------------------------------------------------

Event Type: Error
Event Source: VSS
Event Category: None
Event ID: 8193
Date: 05/08/2006
Time: 11:56:20
User: N/A
Computer: ********
Description:
Volume Shadow Copy Service error: Unexpected error calling routine
CoCreateInstance. hr = 0x80040154.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 2d 20 43 6f 64 65 3a 20 - Code:
0008: 42 55 45 43 58 4d 4c 43 BUECXMLC
0010: 30 30 30 30 33 32 38 37 00003287
0018: 2d 20 43 61 6c 6c 3a 20 - Call:
0020: 42 55 45 43 58 4d 4c 43 BUECXMLC
0028: 30 30 30 30 37 30 39 36 00007096
0030: 2d 20 50 49 44 3a 20 20 - PID:
0038: 30 30 30 30 37 30 34 30 00007040
0040: 2d 20 54 49 44 3a 20 20 - TID:
0048: 30 30 30 30 34 32 36 30 00004260
0050: 2d 20 43 4d 44 3a 20 20 - CMD:
0058: 76 73 73 61 64 6d 69 6e vssadmin
0060: 20 6c 69 73 74 20 77 72 list wr
0068: 69 74 65 72 73 20 20 20 iters
0070: 2d 20 55 73 65 72 3a 20 - User:
0078: 99 99 99 99 99 99 99 99 xxxxxxxx
0080: 99 99 5c 61 64 6d 69 6e xx\admin
0088: 69 73 74 72 61 74 6f 72 istrator
0090: 2d 20 53 69 64 3a 20 20 - Sid:
0098: 53 2d 31 2d 35 2d 32 31 S-1-5-21
00a0: 2d 31 33 33 34 30 36 39 -1334069
00a8: 31 34 30 2d 32 38 31 31 140-2811
00b0: 34 32 31 32 31 35 2d 32 421215-2
00b8: 36 30 30 34 35 33 34 30 60045340
00c0: 32 2d 35 30 30 20 20 20 2-500

----------------------------------------------------------------

'BUECXMLC' is obviously related to Backup Exec, but the software has been
removed from the system (and this has been rebooted quite a number of times
since). One other major problem I can see is that there doesn't appear to be
any VSS writers installed on or available to the system. Running 'vssadmin
list writers' at the command prompt gives me nothing:

| C:\>vssadmin list writers
| vssadmin 1.1 - Volume Shadow Copy Service administrative command-line tool
| (C) Copyright 2001 Microsoft Corp.
|
|
| C:\>



One other point is that the Volume Shadow Copies are still working, so I can
still roll back to previous versions of files and folders.

I'm currently using a 'borrowed' copy of Acronis True Image Server to create
backups for me - that seems to be going OK, but I'm not happy with having to
improvise this way or be forced to go to this kind of expense to solve this
kind of problem.

I'm getting to the point of resorting to a SysState restore from a couple of
months back!

Help!!!!!!!!


Neil

 

http://blogs.technet.com/sdoakes/archive/2006/02/03/418722.aspx

Try that.

 

Susan,

I had already tried that, but it didn't work. However, I hadn't tried it
since I had removed the hotfix that I had previously installed.

Running it again this morning, it seems... well it has worked!! The vss
writers are listed and NTBackup doesn't hang on shadow copy.

I'll put it down to the fact that I last tried it very late on Friday
night/Sat morning and I must have made a typo or something


Thanks


Neil

 

Sunspots.

Computers also react to sunspots.