"Volume Shadow Copy Service" error

  

"Volume Shadow Copy Service" error:

A)Shadow Copies:
    Local Disk Properties > Error 0x8004230f

B) Event ID: 12293 Event Source: VSS - 0x8000ffff Cannot ask provider

C) Event ID: 12293 Event Source: VSS - 0x8000ffff Error Shadow Copy Provider

D) ntbackup systemstate error: 
    Error returned while creating the volume shadow copy:8004230f

E) Symantec NetBackup can't open object: 
    Shadow Copy Components: 0xE000FECB     0xE000FEDD

F) cause / Ursache

G) HOW TO FIX issues A) - E)

H) various issues after KB940032:
    (Symptoms and fix)
        Eventlog Appl: Source: VSS, Event ID: 12293  - 12298  - 12310
        Eventlog System: Source: Volsnap, EventID: 8
how to fix

symptoms A) - E):

A)
Local Disk > Properties >  "Shadow Copies": 

Failed to retrieve volumes that are eligible for shadow copies. Error 0x8004230f: The shadow copy provider had an unexpected error while trying to process the specified operation.




# Various 'Volume Shadow Copy Service' error:
# Fehlercode: 8004230f = VSS_E_UNEXPECTED_PROVIDER_ERROR


B)
Event Type: Error
Event Source: VSS
Event Category: None
Event ID: 12293
Description:
Volume Shadow Copy Service error: Error calling a routine on the Shadow Copy Provider {b5946137-7b9f-4925-af80-51abd60b20d5}. Routine details Cannot ask provider {b5946137-7b9f-4925-af80-51abd60b20d5} if volume is supported. [0x8000ffff] [hr = 0x8000ffff].


C)
Event Type: Error
Event Source: VSS
Event Category: None
Event ID: 12293
Description:
Volume Shadow Copy Service error: Error calling a routine on the Shadow Copy Provider {b5946137-7b9f-4925-af80-51abd60b20d5}. Routine details IVssSnapshotProvider::QueryVolumesSupportedForSnapshots(ProviderId,-1,...) [hr = 0x8000ffff].


D)
ntbackup systemstate error:
(ntbackup-logfile) 

Backup Status 
Operation: Backup
Active backup destination: File
Media name: "Backup.bkf created 05.09.2020 at 17:12"
Volume shadow copy creation: Attempt 1.
Error returned while creating the volume shadow copy:0x8004230f.

Aborting Backup.

----------------------

The operation did not successfully complete. 

----------------------


E)
Symantec NetBackup log:

WRN - can't open object: Shadow Copy Components: (BEDS 0xE000FECB: A failure occurred accessing the backup component document.)
WRN - can't open object: Shadow Copy Components:\System State\System Files\System Files (BEDS 0xE000FEDD: A failure occurred accessing the object list.)
WRN - can't open object: Shadow Copy Components:\System State\COM+ Class Registration Database\COM+ REGDB (BEDS 0xE000FEDD: A failure occurred accessing the object list.)
WRN - can't open object: Shadow Copy Components:\System State\Registry\Registry (BEDS 0xE000FEDD: A failure occurred accessing the object list.)
WRN - can't open object: Shadow Copy Components:\System Service\Windows Management Instrumentation\WMI (BEDS 0xE000FEDD: A failure occurred accessing the object list.)
WRN - can't open object: Shadow Copy Components:\System Service\Event Logs\Event Logs (BEDS 0xE000FEDD: A failure occurred accessing the object list.)

F) cause / Ursache:

Cause the VSC VSS issues:
volsnap.sys not bound on disk

Die neue Festplatte hat eine andere Signatur.
Die alte Signature ist jedoch noch im folgenden Schlüssel gespeichert:

New DISK, new Signature.       old Signature is currently stored within
SYSTEM\ControlSet00x\Enum\STORAGE\Volume\1&30a96598&0&>>Signaturexxxxx<<Offset13873BA800Length86AB65800)

G) How to fix A) - E):

doing:
Delete current SubRegKey: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet00x\Enum\STORAGE\Volume
Note: only offline! this is a long way...


better than ...
A) Speed Fix / schnelle Lösung

write new disk signatur online with MbrFix.exe  (www.sysint.no) 


mbrfix /drive 0 readsignature >> read the current signature from MBR
mbrfix /drive 0 writesignature 12345678 >> writes an new signatur into MBR



restart

Windows detect new hdd, install drivers and write a new subkey within "HKLM\SYSTEM\ControlSet00x\Enum\STORAGE\Volume\" 


restart, done!




B) the long way:

Delete the SubRegKeys below the current Key "HKLM\SYSTEM\ControlSet00x\Enum\STORAGE\Volume\"


@'*#!§? :-)
- customer changed hardware config (disk to raid)

RESULT: 
- backup did not work after hardware change

CAUSE: 
- volsnap.sys not correctly bound to new disk (nt!_DEVICE_NODE.ServiceName 
damaged)

RESOLUTION:
--- volsnap.sys not bound to volume
- in VSS trace:
[0000935375,0x001cf0:0x1d1c:0x0d5c3c93] server\inc\ichannel.hxx(0389): CVssMachineInformation::ReadMinDiffArea: IOCTL sent: 534058 on device \\?\Volume{10f8fde4-a270-11dc-b87d-806e6f6e6963}
Input buffer size: 0, Output buffer size: 4096
[0000935390,0x001cf0:0x1d1c:0x0d5c3c93] server\inc\ichannel.hxx(0428): CVssMachineInformation::ReadMinDiffArea: Could not send the IOCTL 0x00534058 on device \\?\Volume{10f8fde4-a270-18dc-b87d-806e6f6e7983} - 0x00000180. 
[0x00000001]
[0000935437,0x001cf0:0x1d1c:0x0d4c3c99] server\inc\ichannel.hxx(0428): 
CVssMachineInformation::ReadMinDiffArea: Throwing HRESULT code 0x8000ffff. Previous 
HRESULT code = 0x00000000
--- solution for volsnap.sys not bound to volume



delete keys below HKLM\system\currentcontrolset\enum\storage\volume\ .. 
this step ensured, that volsnap.sys is properly bound to the volumes again (solved problem with the netnode)



detailed steps for the key deletion: 
A) english B) deutsch

A) english
Action plan:

1) Run WinPE, BartPE, ERDCommander, Parallelinstallation, Parallelsystem
2) start regedit
3) Regedit-> select "HKEY_USERS" -> click Menu "File" -> select "Load Hive"
load the SYSTEM Hive (e.g. C:\WINDOWS\system32\config\ File: "system")
give one name for the loaded hive: "TEST"
4) view on 
"HKEY_USERS\TEST\SYSTEM\Select\"    Value="Current" 
This Value point to the current ControlSet: "ControlSet001" or "ControlSet00x" or "ControlSet00y"
5) now go to the specified Current ControlSet00x: 
"HKEY_USERS\TEST\SYSTEM\ControlSet00x\" within the loaded hive 
and expand to:
"\SYSTEM\ControlSet00x\Enum\STORAGE\Volume\"
and delete all subkeys below \SYSTEM\ControlSet002\Enum\STORAGE\Volume\
(e.g. "HKEY_USERS\TEST\SYSTEM\ControlSet00x\Enum\STORAGE\Volume\1&30a96598&0&Signature12345678Offset13873BA800Length86AB600)"
6) unload the hive (Regedit->File->Unload Hive)
7) shutdown und boot original system
8) Windows detect new vol, install drivers and write the new keys > reboot and ready


B) deutsch
Löschen der SubRegKeys unterhalb des aktuellen
 "HKLM\SYSTEM\ControlSet00x\Enum\STORAGE\Volume\"

1) Starte Win_PE usw.
2) regedit starten
3) Regedit-> markieren von "HKEY_USERS" -> Klick Menü "Datei" -> "Struktur laden..."
gehe zu "SYSTEM" (z.B. %SystemRoot%\system32\config\    Datei: "system")
jetzt einen Namen für die zu ladende Struktur vergeben: "TEST"
4) unter 
HKEY_USERS\TEST\SYSTEM\Select\ mit dem WERT="Current" 
steht der Verweis, welcher ControlSet00x der Aktuelle ist.
5) gehe zum aktuellen "HKEY_USERS\TEST\SYSTEM\ControlSet00x",
navigiere bis zum Schlüssel "\SYSTEM\ControlSet00x\Enum\STORAGE\Volume\"
und lösche alle Schlüssel innerhalb von "\SYSTEM\ControlSet00x\Enum\STORAGE\Volume\"
(z.B. HKEY_USERS\TEST\SYSTEM\ControlSet00x\Enum\STORAGE\Volume\1&30a96598&0&Signature35633562Offset13873BA800Length86AB65800)
6) Datei > "Struktur entladen.."
7) shutdown Win_PE, danach das originale System booten
8) Windows erkennt eine neue Festplatte und schreibt die Schlüssel neu > reboot und fertig

H) various issues after KB940032:

Eventlog Appl: Source: VSS, Event ID: 12293  - 12298  - 12310
Eventlog System: Source: Volsnap, EventID: 8

cause:
"regsvr32 /i eventcls.dll" dosnt work fine!

symptoms:

vssadmin "list writers" take a long time

after any minutes:

Writer name: 'Removable Storage Manager'
Writer Id: {5d3c3e01-0297-445b-aa81-a48d7151e235}
Writer Instance Id: {e94e87e2-375a-4f10-a3e6-9a5534ccdd9c}
State: [9] Failed
Last error: Not responding

Event Type: Error
Event Source: VSS
Event ID: 12301
Description:
Volume Shadow Copy Service error: Writer Removable Storage Manager did not respond to a GatherWriterStatus call.

and VSS: EventID 8 - time out

result:
the Value "OwnerSID" within

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EventSystem\{26c409cc-ae86-11d1-b616-00805fc79216}\EventClasses\{FAF53CC4-BD73-4E36-83F1-2B23F46E513E}-{00000000-0000-0000-0000-000000000000}-{00000000-0000-0000-0000-000000000000}]

are changed from default "S-1-5-18" to your SID  "OwnerSID"="S-1-5-21-xxxxx-xxxxxxx-xxxxxxx-xxxxx"

and

the Value "TypeLib" points not into %SystemRoot%
"TypeLib"="C:\\EVENTCLS.DLL"

change the value to systemroot and type  "S-1-5-18".


how to:

Please check if these keys exist, that system can access these keys and that there's the correct path to EVENTCLS.DLL:

----------------------------------------------------

Key Name: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EventSystem\{26c409cc-ae86-11d1-b616-00805fc79216}\EventClasses\{FAF53CC4-BD73-4E36-83F1-2B23F46E513E}-{00000000-0000-0000-0000-000000000000}-{00000000-0000-0000-0000-000000000000}

Class Name: <NO CLASS>

Value Name: Active
Type: REG_DWORD
Data: 0x1

Value Name: EventClassID
Type: REG_SZ
Data: {FAF53CC4-BD73-4E36-83F1-2B23F46E513E}

Value Name: EventClassName
Type: REG_SZ
Data: VssEvent

Value 3 Name: OwnerSID
Type: REG_SZ
Data: S-1-5-18

Value Name: TypeLib
Type: REG_SZ
Data: G:\WINDOWS\system32\EVENTCLS.DLL
======> This key should point to %windir%\system32\eventcls.dll


Value Name: AllowInprocActivation
Type: REG_DWORD
Data: 0xffffffff

Value Name: FireInParallel
Type: REG_DWORD
Data: 0

Value Name: EventClassPartitionID
Type: REG_SZ
Data: {00000000-0000-0000-0000-000000000000}

Value Name: EventClassApplicationID
Type: REG_SZ
Data: {00000000-0000-0000-0000-000000000000}