A Volume Shadow Copy Service (VSS) update package is available for Windows Server 2003

Article translations Article translations
Article ID: 833167 - View products that this article applies to.
Expand all | Collapse all

On This Page

Introduction

A hotfix update to the Volume Shadow Copy service for Microsoft Windows Server 2003 is available. This update package addresses the following specific symptoms:

SYMPTOMS

Software shadow copies do not complete on large volumes that use a small cluster size


When you try to create shadow copies on large volumes that have a small cluster size (for example, less than 4 kilobytes [KB]), or if you take snapshots of several very large volumes at the same time, the VSS software provider may use a larger paged pool memory allocation during the shadow copy creation than is required. If there is not sufficient paged pool memory available for the allocation, the shadow copy cannot complete and may cause the loss of all previous shadow copy tasks. When this problem occurs, the following error messages may also appear in the application event log:
Event Type:	Error
Event Source:	VolSnap
Event Category:	None 
Event ID: 		5
Description:
The shadow copy of volume X: could not be created due to insufficient non-paged memory pool 
for a bitmap structure.
Event Type:	Error
Event Source:	VolSnap
Event Category:	None
Event ID:		20
Description:
The shadow copies of volume X: were aborted because of a failed free space computation.
Event Type:      Error
Event Source:    VolSnap
Event Category:  None
Event ID:        28
Description:
The shadow copy of volume X: could not be created due to a failure in creating the necessary on 
disk structures.
 
Data:
0000: 00 00 00 00 02 00 58 00   ......X.
0008: 00 00 00 00 1c 00 06 c0   .......À
0010: 00 00 00 00 9a 00 00 c0   ....š..À
0018: 3d 00 00 00 00 00 00 00   =.......
0020: 00 00 00 00 00 00 00 00   ........
Note You may receive other events that are not described in this article. A value of 0xc000009a (STATUS_INSUFFICIENT_RESOURCES) in the NTSTATUS part of the event at offset 0x14 indicates a problem with the memory resource allocation.

Resolution This update fixes the memory allocation issue. You may still experience this symptom if you do not have sufficient memory available to perform the copy operation.

Time-out errors occur in volume shadow copy service writers, and shadow copies are lost during backup or during instances of high input/output activity


When you start a backup process, some Volume Shadow Copy service writers may receive time-out errors that cause the backup to fail. A Volume Shadow Copy service writer is a program or a service that uses the Volume Shadow Copy service to save information before a shadow copy is created. For example, when you use a backup program (such as NTBackup), the backup may not be completed, and you may receive the following error message:
Error returned while creating the volume shadow copy: 800423f4 (or the values 800423f2 or 800423f3).
To diagnose the Volume Shadow Copy service writer problem, run the vssadmin command immediately after the backup failure:
  1. Click Start, and then click Run.
  2. Type vssadmin list writers.
This command lists the Volume Shadow Copy service writers and the current state of each writer. For example, the output might indicate that the Microsoft SQL Server Desktop Engine (MSDE) or the Microsoft Active Directory writer failed. You may experience time-out errors on several writers, including the MSDE writer, the SQL writer, the NT Directory Service (NTDS) writer, the Windows Internet Naming System (WINS) writer, the Dynamic Host Configuration Protocol (DHCP) writer, the Remote Storage writer, the certification authority writer, and the Microsoft Exchange writer. The following is sample output:
C:\>VSSADMIN LIST WRITERS
[...]
Writer name: 'NTDS'
Writer Id: {b2014c9e-8711-4c5c-a5a9-3cf384484757}
Writer Instance Id: {26ed439f-4a52-481d-963d-5db5b695d9e7}
State: [10] Failed
Last error: Retryable error
Additionally, certain time-out errors can be identified by looking in the application event log. The following are two examples:
Event ID: 12290
Description: 
Volume Shadow Copy Service warning: ESENT ERROR {b2014c9e-8711-4c5c-a5a9-3cf384484757} NTDS: -2402. hr = 0x00000000. 
Event ID: 2004
Description: 
Shadow copy 6 time-out (20000 ms). 
You may experience a problem that causes certain Volume Shadow Copy service writers to time out during a lengthy shadow copy creation. This problem occurs especially on computers that have slow hard disk drives, low memory, or low CPU speed. This problem may also occur on computers that have the disk write cache disabled (for example, on a domain controller computer).

Shadow copy creation includes a complex sequence of inter-process calls. The inter-process calls make sure that all the important Volume Shadow Copy service writers flush their data buffers during shadow copy creation. These programs include SQL, Exchange Server, operating system services, and other programs. Additionally, some Volume Shadow Copy service writers, like the Exchange writer, do not write during a predefined time interval. This waiting period permits the shadow copy to be created during the time interval. The writers wait to write so that the contents of the shadow copy will be consistent with their data buffers. However, if there is low CPU speed, high memory usage, or high input/output levels, you may experience the following behaviors:
  • The writers do not flush their data buffers.
  • The writers do not wait the time interval before they write.
When this problem occurs, shadow copy creation fails.

Important Volume Shadow Copy service writers may fail with similar errors because of other conditions. These conditions include a lack of disk space or improper configuration of the computer. This hotfix addresses only the specific time-out errors that might randomly occur in Volume Shadow Copy service writers during backup. Microsoft highly recommends that you review the event log for any other potential Volume Shadow Copy service errors that might generate a writer failure.

Another related symptom is that shadow copies of shared network folders may have been deleted. When this problem occurs, the following error message appears in the event log:
Event Type: Error
Event Source: VolSnap
Event Category: None
Event ID: 25
Description: 
The shadow copies of volume VolumeName were aborted because the diff area file could not grow in time. Consider reducing the IO load on this system to avoid this problem in the future.  
In the message, VolumeName is the name of the volume that is scheduled for backup.

You may also experience a problem in the Volsnap.sys driver that causes the shadow copy to be deleted wheninput/output is high. This problem may occur especially when the disk write cache is disabled (for example, on a domain controller computer).

By default, the shadow copy provider that is included in Microsoft Windows Server 2003 is used to create shadow copies for backup purposes. The shadow copies are implemented by using a copy-on-write implementation. The differences are copied in the shadow copy storage area. In the Volume Shadow Copy service, you can use either the shadow copy management tool or the vssadmin command.

In the original released version of Windows Server 2003, the initial shadow copy storage area that is allocated for shadow copy creation is 100 megabytes (MB). However, the actual space that is used is much smaller. As time passes, the allocated space may increase as more data is modified on the original volume. However, when input/output traffic is high on the original volume, the shadow copy storage area cannot grow fast enough to hold all the copy-on-write changes. This behavior causes deletion of all the shadow copies on the original volume. This problem is more noticeable in domain controller configurations. By default, the disk write cache is disabled in domain controller configurations.

Important A similar problem is caused by defragmenting a volume that has a small cluster size. In this situation, all shadow copies are deleted, and the event error that is listed in earlier this section is logged. For additional information about losing shadow copies during a disk defragmentation, click the following article number to view the article in the Microsoft Knowledge Base:
312067 Shadow copies may be lost when you defragment a volume
Additionally, event error ID 2004 may be logged when there are corrupted NTFS file system volumes. To determine whether this is the problem, run the Chkdsk.exe program with the /f switch.

Large Audit Log. Writer time-out errors might also appear during a system-state backup if the security (audit) log is extremely large. It is best to back up the system-state periodically, or to clear the log periodically.

Resolution This hotfix reduces the occurrence of this issue by permitting certain writers more time to prepare for the shadow copy process. This hotfix also changes the minimum initial shadow copy storage area from 100 MB to 300 MB.

Plug and Play (PnP) surprise removal event is created when you delete a hardware shadow copy


A hardware shadow copy is a shadow copy that is performed in a hardware storage array. Hardware shadow copies appear similar to and are treated similar to disks and logical unit numbers (LUNs) by Windows Server 2003. When a disk or an LUN is suddenly removed from a system, an event message is logged that details the surprise removal. Similarly, for hardware shadow copies, an event message is logged when shadow copies are deleted. When you delete a hardware shadow copy, the following error messages may also appear in the application event log:
Event Type: Error	
Event Source: PlugPlayManager
Event Category: None
Event ID: 12	
Description:
The device 'Manufacturer Model (C) SCSI Disk Device' (SCSI\Disk&Ven_Vendor&Prod_Product_(C)Vendor&Rev_2001\4&13376f61&0&1017) disappeared from the system without first being prepared for removal.
Event Type: Error
Event Source: VSS
Event Category: None
Description:
Volume Shadow Copy Service error: Unexpected error calling routine DeleteVolumeMountPoint.  hr = 0x80070002  
Resolution This update package resolves the issue by correctly removing the shadow copy volume and the disk devices.

Shadow copies do not work in a cluster that has multiple Windows system paths or when the ADMIN$ share has been deleted


When you turn on shadow copies for shared folders in a cluster, the shadow copy scheduled task may not complete when different nodes in the cluster have different Windows folder paths (for example, %windir%). For example, if the Windows installation path for node A is c:\winnt and the path for node B is c:\windows, the scheduled task may not work after failing over from node A to node B.

You may also receive the following error message when you try to schedule a shadow copy:
Failed to create a default schedule for creating shadow of disk X" 0x80070906 This shared resource does not exist.
This issue may occur if the ADMIN$ share has been removed from a system, even in non-clustered scenarios.

Resolution This update package resolves these issues. Multiple Windows system paths are now detected, and the ADMIN$ share is no longer required when you schedule a shadow copy task.

A hardware shadow copy resource can be orphaned if you cancel a hardware shadow copy create operation


When you create a hardware shadow copy that will be automatically imported on the same computer where the shadow copy was created, the shadow copy resource may be orphaned if you cancel the operation. This symptom occurs only when the following conditions are true:
  • When you use a hardware shadow copy that is configured to be automatically imported to the same computer (by using the autoimport context)
  • When the hardware shadow copy is canceled when the shadow copy is created.
To delete the hardware resource, a user who has administrator credentials must delete the resource manually by using the management program of the storage device.

Resolution This update package resolves this issue by detecting whether an automatic import configuration exists.

An error 0x800700EA occurs when you try to import a hardware shadow copy


In some circumstances, a hardware shadow copy may not import. When this symptom occurs, you may receive the following event message:
Event Type:		Error
Event Source:	VSS
Event Category:	None
Event ID:		8193
Description:
Volume Shadow Copy Service error: Unexpected error calling routine DeviceIoControl(IOCTL_VOLMGR_QUERY_HIDDEN_VOLUMES.  hr = 0x800700ea.
Resolution This update package resolves this issue.

A shadow copy may become corrupted on volumes that are very fragmentedOn a volume that is very fragmented and where shadow copy is turned on, the shadow copy may become corrupted.

Resolution This update package resolves this issue.

Hardware shadow copy shows a NULL device path


You may not be able to successfully create a hardware shadow copy. However, the shadow copy is reported as successful with a NULL device path. This issue may occur when the hardware storage device cannot create the shadow copy. However, the failure and the error code are masked. The requesting program reports a failure while trying to access the shadow copy.

Resolution This update package resolves this issue. The failure and the error code are correctly returned to the program.

Volumes may disappear when you run hardware shadow copies in a clustered environment


A volume may disappear when you run a hardware shadow copy and when the volume is part of a managed resource in a cluster. This problem occurs when the cluster disk driver does not pass some operations between the layers in the storage stack.

Resolution This update package resolves this issue. The cluster disk driver now passes the correct operations.

A computer may stop responding if the Shadow Copies for Shared Folders option is turned on when you try to import hardware shadow copies


This symptom occurs when you use hardware shadow copies and when you follow these steps:
  1. You have turned on Shadow Copies for Shared Folders on the volume.
  2. You perform a hardware shadow copy on that volume.
  3. You import the hardware shadow copy.
  4. You break the hardware shadow copy (for example, you convert to a LUN).
  5. You configure the new LUN with read/write operation.
Resolution: This update package resolves this issue.

Some VSS operations may not complete after a hardware shadow copy fails over in a clustered environment


When a cluster fail-over occurs, some input/output tasks may not complete while the storage resources are in process to return online on another cluster node. When this symptoms occurs, the storage stack may detect some sectors of a hardware shadow copy as bad sectors. Some VSS operations do not complete, and you may receive the following event in the application log:
    Event Type: 	Error
    Event Source:	VSS
    Event Category:	None
    Event ID: 		8193
    Computer: 		Computer_name
    Description:
    Volume Shadow Copy Service error: Unexpected error calling routine
    DeviceIoControl(IOCTL_VOLUME_SET_GPT_ATTRIBUTES).  
    hr = 0x80070057
Resolution This update package resolves this issue. The storage stack will retry the operations.

The Cluster service may not start after you upgrade to Microsoft Windows Server 2003


When you upgrade a cluster from Windows 2000 Server to Windows Server 2003, the service account may not be an explicit member of the local administrators group. In Windows Server 2003, the Cluster service hosts a VSS writer. The service may not start if the service account is not an explicit member of the local administrator group.

Resolution This updatepackage resolves this issue. The Cluster service account is added to the VSS custom account list.

VSS cannot create snapshots on logical unit numbers that are on Internet Small Computer System Interface (iSCSI) drives


When you try to create a snapshot on an LUN that is on an iSCSI volume, you may receive the following event message:
Source:  VSS
EventID:  8193
Description:
Volume Shadow Copy Service Error: Unexpected error calling routine IVssLunInformation::SetBasicType hr=0x80070057.
Resolution This update package adds support for iSCSI hardware.

Note Microsoft recommends that you run Microsoft iSCSI Software Initiator version 1.02 or later. For more information about iSCSI drives, visit the following Microsoft Storage Technologies - iSCSI Web site:http://www.microsoft.com/WindowsServer2003/technologies/storage/iscsi/default.mspx

SQL MSDE Writer returns an error if the database is offline during a restore


When you try to restore a SQL database, the MSDE writer (as part of the VSS process) tries to communicate to the SQL instance. If you perform a restore operation while the SQL MSDE instance is not running, the MSDE writer cannot connect. The MSDE writer reports a failure to the backup application and causes the restore operation to fail. The following error message also appears in the application event log:
Event Type: Error 
Event Source: VSS 
Event Category: None 
Event ID: 6013 
Description: 
Sqllib error: OLEDB Error encountered calling IDBInitialize::Initialize. hr = 0x80004005. 
   SQLSTATE: 08001, Native Error: 17 Error state: 1, Severity: 16 
Source: Microsoft OLE DB Provider for SQL Server Error message: 
   [DBNETLIB][ConnectionOpen (Connect()).] 
   SQL Server does not exist or access denied.
Resolution This update package resolves this issue.

RESOLUTION

Service pack information

To resolve this problem, obtain the latest service pack for Windows Server 2003. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
889100 How to obtain the latest service pack for Windows Server 2003

Hotfix information

A supported hotfix is available from Microsoft. However, this hotfix is intended to correct only the problem that is described in this article. Apply this hotfix only to systems that are experiencing this specific problem. This hotfix might receive additional testing. Therefore, if you are not severely affected by this problem, we recommend that you wait for the next software update that contains this hotfix.

If the hotfix is available for download, there is a "Hotfix download available" section at the top of this Knowledge Base article. If this section does not appear, contact Microsoft Customer Service and Support to obtain the hotfix.

Note If additional issues occur or if any troubleshooting is required, you might have to create a separate service request. The usual support costs will apply to additional support questions and issues that do not qualify for this specific hotfix. For a complete list of Microsoft Customer Service and Support telephone numbers or to create a separate service request, visit the following Microsoft Web site:
http://support.microsoft.com/contactus/?ws=support
Note The "Hotfix download available" form displays the languages for which the hotfix is available. If you do not see your language, it is because a hotfix is not available for that language.

Prerequisites

No prerequisites are required.

Restart Requirement

You must restart your computer after you apply this hotfix.

Hotfix Replacement Information

This hotfix replaces the following hotfix:
826936 Time-out errors occur in Volume Shadow Copy Service writers, and shadow copies are lost during backup and during times when there are high levels of input/output

File Information

The English version of this hotfix has the file attributes (or later) that are listed in the following table. The dates and times for these files are listed in coordinated universal time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time tool in Control Panel.
   Date         Time   Version            Size    File name
   --------------------------------------------------------------
   18-Dec-2003  20:04  5.2.3790.114       59,392  Clusdisk.sys
   26-Dec-2003  23:02  5.2.3790.113      225,280  Dmadmin.exe      
   26-Dec-2003  23:02  5.2.3790.109    1,055,232  Esent.dll        
   18-Dec-2003  07:21  5.2.3790.113      129,536  Ftdisk.sys
   26-Dec-2003  23:02  5.2.3790.113      273,920  Swprv.dll        
   18-Dec-2003  07:16  5.2.3790.113      116,736  Volsnap.sys
   18-Dec-2003  07:16  5.2.3790.113      131,584  Vssadmin.exe     
   26-Dec-2003  23:02  5.2.3790.113      542,720  Vssapi.dll       
   26-Dec-2003  23:02  5.2.3790.113      130,560  Vssui.dll        
   18-Dec-2003  07:16  5.2.3790.113      663,040  Vssvc.exe        
   26-Dec-2003  23:02  5.2.3790.113       18,432  Vss_ps.dll       
   16-Dec-2003  17:55  5.2.3790.113       37,888  Ws03res.dll 

STATUS

Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section. This problem was first corrected in Windows Server 2003 Service Pack 1.

MORE INFORMATION

For more information about the Volume Shadow Copy service (VSS), click the following article number to view the article in the Microsoft Knowledge Base:
327948 Windows Server 2003 compatibility with former backup software
For more information about software update terminology, click the following article number to view the article in the Microsoft Knowledge Base:
824684Description of the standard terminology that is used to describe Microsoft software updates

Properties

Article ID: 833167 - Last Review: October 9, 2011 - Revision: 7.0
APPLIES TO
  • Microsoft Windows Server 2003, Standard Edition (32-bit x86)
  • Microsoft Windows Server 2003, Enterprise Edition (32-bit x86)
  • Microsoft Windows Server 2003, Web Edition
  • Microsoft Windows Server 2003, Enterprise x64 Edition
Keywords: 
kbautohotfix kbwinserv2003sp1fix atdownload kbhotfixserver kbbug kbfix kbqfe kbwinserv2003presp1fix KB833167

Give Feedback

 

Contact us for more help

Contact us for more help
Connect with Answer Desk for expert help.
Get more support from smallbusiness.support.microsoft.com