A Volume Shadow Copy Service (VSS) update package is available for Windows Server 2003

A hotfix update to the Volume Shadow Copy service for Microsoft Windows Server 2003 is available. This update package addresses the following specific symptoms:

• Software shadow copies do not complete on large volumes that use a small cluster size
• Time-out errors occur in volume shadow copy service writers, and shadow copies are lost during backup or during instances of high input/output activity
• Plug and Play (PnP) surprise removal event is created when you delete a hardware shadow copy
• Shadow copies do not work in a cluster that has multiple Windows system paths or when the ADMIN$ share has been deleted
• A hardware shadow copy resource can be orphaned if you cancel a hardware shadow copy create operation
• An error 0x800700EA occurs when you try to import a hardware shadow copy
• A shadow copy may become corrupted on volumes that are very fragmented
• Hardware shadow copy shows a NULL device path
• Volumes may disappear when you run hardware shadow copies in a clustered environment
• A computer may stop responding if the Shadow Copies for Shared Folders option is turned on when you try to import hardware shadow copies
• Some VSS operations may not complete after a hardware shadow copy fails over in a clustered environment
• The Cluster service may not start after you upgrade to Microsoft Windows Server 2003
• VSS cannot create snapshots on logical unit numbers that are on Internet Small Computer System Interface (iSCSI) drives
• SQL MSDE Writer returns an error if the database is offline during a restore

Software shadow copies do not complete on large volumes that use a small cluster size

When you try to create shadow copies on large volumes that have a small cluster size (for example, less than 4 kilobytes [KB]), or if you take snapshots of several very large volumes at the same time, the VSS software provider may use a larger paged pool memory allocation during the shadow copy creation than is required. If there is not sufficient paged pool memory available for the allocation, the shadow copy cannot complete and may cause the loss of all previous shadow copy tasks. When this problem occurs, the following error messages may also appear in the application event log: Note You may receive other events that are not described in this article. A value of 0xc000009a (STATUS_INSUFFICIENT_RESOURCES) in the NTSTATUS part of the event at offset 0x14 indicates a problem with the memory resource allocation.

Resolution This update fixes the memory allocation issue. You may still experience this symptom if you do not have sufficient memory available to perform the copy operation.

Time-out errors occur in volume shadow copy service writers, and shadow copies are lost during backup or during instances of high input/output activity

When you start a backup process, some Volume Shadow Copy service writers may receive time-out errors that cause the backup to fail. A Volume Shadow Copy service writer is a program or a service that uses the Volume Shadow Copy service to save information before a shadow copy is created. For example, when you use a backup program (such as NTBackup), the backup may not be completed, and you may receive the following error message:To diagnose the Volume Shadow Copy service writer problem, run the vssadmin command immediately after the backup failure:

1. Click Start, and then click Run.
2. Type vssadmin list writers.

This command lists the Volume Shadow Copy service writers and the current state of each writer. For example, the output might indicate that the Microsoft SQL Server Desktop Engine (MSDE) or the Microsoft Active Directory writer failed. You may experience time-out errors on several writers, including the MSDE writer, the SQL writer, the NT Directory Service (NTDS) writer, the Windows Internet Naming System (WINS) writer, the Dynamic Host Configuration Protocol (DHCP) writer, the Remote Storage writer, the certification authority writer, and the Microsoft Exchange writer. The following is sample output:Additionally, certain time-out errors can be identified by looking in the application event log. The following are two examples: You may experience a problem that causes certain Volume Shadow Copy service writers to time out during a lengthy shadow copy creation. This problem occurs especially on computers that have slow hard disk drives, low memory, or low CPU speed. This problem may also occur on computers that have the disk write cache disabled (for example, on a domain controller computer).

Shadow copy creation includes a complex sequence of inter-process calls. The inter-process calls make sure that all the important Volume Shadow Copy service writers flush their data buffers during shadow copy creation. These programs include SQL, Exchange Server, operating system services, and other programs. Additionally, some Volume Shadow Copy service writers, like the Exchange writer, do not write during a predefined time interval. This waiting period permits the shadow copy to be created during the time interval. The writers wait to write so that the contents of the shadow copy will be consistent with their data buffers. However, if there is low CPU speed, high memory usage, or high input/output levels, you may experience the following behaviors:

• The writers do not flush their data buffers.
• The writers do not wait the time interval before they write.

When this problem occurs, shadow copy creation fails.

Important Volume Shadow Copy service writers may fail with similar errors because of other conditions. These conditions include a lack of disk space or improper configuration of the computer. This hotfix addresses only the specific time-out errors that might randomly occur in Volume Shadow Copy service writers during backup. Microsoft highly recommends that you review the event log for any other potential Volume Shadow Copy service errors that might generate a writer failure.

Another related symptom is that shadow copies of shared network folders may have been deleted. When this problem occurs, the following error message appears in the event log: In the message, VolumeName is the name of the volume that is scheduled for backup.

You may also experience a problem in the Volsnap.sys driver that causes the shadow copy to be deleted wheninput/output is high. This problem may occur especially when the disk write cache is disabled (for example, on a domain controller computer).

By default, the shadow copy provider that is included in Microsoft Windows Server 2003 is used to create shadow copies for backup purposes. The shadow copies are implemented by using a copy-on-write implementation. The differences are copied in the shadow copy storage area. In the Volume Shadow Copy service, you can use either the shadow copy management tool or the vssadmin command.

In the original released version of Windows Server 2003, the initial shadow copy storage area that is allocated for shadow copy creation is 100 megabytes (MB). However, the actual space that is used is much smaller. As time passes, the allocated space may increase as more data is modified on the original volume. However, when input/output traffic is high on the original volume, the shadow copy storage area cannot grow fast enough to hold all the copy-on-write changes. This behavior causes deletion of all the shadow copies on the original volume. This problem is more noticeable in domain controller configurations. By default, the disk write cache is disabled in domain controller configurations.

Important A similar problem is caused by defragmenting a volume that has a small cluster size. In this situation, all shadow copies are deleted, and the event error that is listed in earlier this section is logged. For additional information about losing shadow copies during a disk defragmentation, click the following article number to view the article in the Microsoft Knowledge Base: Additionally, event error ID 2004 may be logged when there are corrupted NTFS file system volumes. To determine whether this is the problem, run the Chkdsk.exe program with the /f switch.

Large Audit Log. Writer time-out errors might also appear during a system-state backup if the security (audit) log is extremely large. It is best to back up the system-state periodically, or to clear the log periodically.

Resolution This hotfix reduces the occurrence of this issue by permitting certain writers more time to prepare for the shadow copy process. This hotfix also changes the minimum initial shadow copy storage area from 100 MB to 300 MB.

Plug and Play (PnP) surprise removal event is created when you delete a hardware shadow copy

A hardware shadow copy is a shadow copy that is performed in a hardware storage array. Hardware shadow copies appear similar to and are treated similar to disks and logical unit numbers (LUNs) by Windows Server 2003. When a disk or an LUN is suddenly removed from a system, an event message is logged that details the surprise removal. Similarly, for hardware shadow copies, an event message is logged when shadow copies are deleted. When you delete a hardware shadow copy, the following error messages may also appear in the application event log:Resolution This update package resolves the issue by correctly removing the shadow copy volume and the disk devices.

Shadow copies do not work in a cluster that has multiple Windows system paths or when the ADMIN$ share has been deleted

When you turn on shadow copies for shared folders in a cluster, the shadow copy scheduled task may not complete when different nodes in the cluster have different Windows folder paths (for example, %windir%). For example, if the Windows installation path for node A is c:\winnt and the path for node B is c:\windows, the scheduled task may not work after failing over from node A to node B.

You may also receive the following error message when you try to schedule a shadow copy: This issue may occur if the ADMIN$ share has been removed from a system, even in non-clustered scenarios.

Resolution This update package resolves these issues. Multiple Windows system paths are now detected, and the ADMIN$ share is no longer required when you schedule a shadow copy task.

A hardware shadow copy resource can be orphaned if you cancel a hardware shadow copy create operation

When you create a hardware shadow copy that will be automatically imported on the same computer where the shadow copy was created, the shadow copy resource may be orphaned if you cancel the operation. This symptom occurs only when the following conditions are true:

• When you use a hardware shadow copy that is configured to be automatically imported to the same computer (by using the autoimport context)
• When the hardware shadow copy is canceled when the shadow copy is created.

To delete the hardware resource, a user who has administrator credentials must delete the resource manually by using the management program of the storage device.

Resolution This update package resolves this issue by detecting whether an automatic import configuration exists.

An error 0x800700EA occurs when you try to import a hardware shadow copy

In some circumstances, a hardware shadow copy may not import. When this symptom occurs, you may receive the following event message:Resolution This update package resolves this issue.

A shadow copy may become corrupted on volumes that are very fragmentedOn a volume that is very fragmented and where shadow copy is turned on, the shadow copy may become corrupted.

Resolution This update package resolves this issue.

Hardware shadow copy shows a NULL device path

You may not be able to successfully create a hardware shadow copy. However, the shadow copy is reported as successful with a NULL device path. This issue may occur when the hardware storage device cannot create the shadow copy. However, the failure and the error code are masked. The requesting program reports a failure while trying to access the shadow copy.

Resolution This update package resolves this issue. The failure and the error code are correctly returned to the program.

Volumes may disappear when you run hardware shadow copies in a clustered environment

A volume may disappear when you run a hardware shadow copy and when the volume is part of a managed resource in a cluster. This problem occurs when the cluster disk driver does not pass some operations between the layers in the storage stack.

Resolution This update package resolves this issue. The cluster disk driver now passes the correct operations.

A computer may stop responding if the Shadow Copies for Shared Folders option is turned on when you try to import hardware shadow copies

This symptom occurs when you use hardware shadow copies and when you follow these steps:

1. You have turned on Shadow Copies for Shared Folders on the volume.
2. You perform a hardware shadow copy on that volume.
3. You import the hardware shadow copy.
4. You break the hardware shadow copy (for example, you convert to a LUN).
5. You configure the new LUN with read/write operation.

Resolution: This update package resolves this issue.

Some VSS operations may not complete after a hardware shadow copy fails over in a clustered environment

When a cluster fail-over occurs, some input/output tasks may not complete while the storage resources are in process to return online on another cluster node. When this symptoms occurs, the storage stack may detect some sectors of a hardware shadow copy as bad sectors. Some VSS operations do not complete, and you may receive the following event in the application log:Resolution This update package resolves this issue. The storage stack will retry the operations.

The Cluster service may not start after you upgrade to Microsoft Windows Server 2003

When you upgrade a cluster from Windows 2000 Server to Windows Server 2003, the service account may not be an explicit member of the local administrators group. In Windows Server 2003, the Cluster service hosts a VSS writer. The service may not start if the service account is not an explicit member of the local administrator group.

Resolution This updatepackage resolves this issue. The Cluster service account is added to the VSS custom account list.

VSS cannot create snapshots on logical unit numbers that are on Internet Small Computer System Interface (iSCSI) drives

When you try to create a snapshot on an LUN that is on an iSCSI volume, you may receive the following event message:Resolution This update package adds support for iSCSI hardware.

Note Microsoft recommends that you run Microsoft iSCSI Software Initiator version 1.02 or later. For more information about iSCSI drives, visit the following Microsoft Storage Technologies - iSCSI Web site:http://www.microsoft.com/WindowsServer2003/technologies/storage/iscsi/default.mspx (http://www.microsoft.com/WindowsServer2003/technologies/storage/iscsi/default.mspx)

SQL MSDE Writer returns an error if the database is offline during a restore

When you try to restore a SQL database, the MSDE writer (as part of the VSS process) tries to communicate to the SQL instance. If you perform a restore operation while the SQL MSDE instance is not running, the MSDE writer cannot connect. The MSDE writer reports a failure to the backup application and causes the restore operation to fail. The following error message also appears in the application event log:Resolution This update package resolves this issue.

Service pack information

To resolve this problem, obtain the latest service pack for Windows Server 2003. For more information, click the following article number to view the article in the Microsoft Knowledge Base:

Hotfix information

A supported hotfix is available from Microsoft. However, this hotfix is intended to correct only the problem that is described in this article. Apply this hotfix only to systems that are experiencing this specific problem. This hotfix might receive additional testing. Therefore, if you are not severely affected by this problem, we recommend that you wait for the next software update that contains this hotfix.

If the hotfix is available for download, there is a "Hotfix download available" section at the top of this Knowledge Base article. If this section does not appear, contact Microsoft Customer Service and Support to obtain the hotfix.

Note If additional issues occur or if any troubleshooting is required, you might have to create a separate service request. The usual support costs will apply to additional support questions and issues that do not qualify for this specific hotfix. For a complete list of Microsoft Customer Service and Support telephone numbers or to create a separate service request, visit the following Microsoft Web site: Note The "Hotfix download available" form displays the languages for which the hotfix is available. If you do not see your language, it is because a hotfix is not available for that language.

Prerequisites

No prerequisites are required.

Restart Requirement

You must restart your computer after you apply this hotfix.

Hotfix Replacement Information

This hotfix replaces the following hotfix:

File Information

The English version of this hotfix has the file attributes (or later) that are listed in the following table. The dates and times for these files are listed in coordinated universal time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time tool in Control Panel.

Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section. This problem was first corrected in Windows Server 2003 Service Pack 1.

For more information about the Volume Shadow Copy service (VSS), click the following article number to view the article in the Microsoft Knowledge Base: For more information about software update terminology, click the following article number to view the article in the Microsoft Knowledge Base: