Event ID 215 is logged after you use the NTBackup utility to perform a system state backup on a computer that is running Windows Server 2003

Consider the following scenario. On a computer that is running Microsoft Windows Server 2003, you set up a certification authority (CA). Then, you use the NTBackup utility to perform a system state backup. In this scenario, the following event is logged in the event log:

Event Type: Error
Event Source: ESENT
Event Category: Logging/Recovery
Event ID: 215
Date: <Date>
Time: <Time>
User: N/A
Computer: <ComputerName>
Description: certsrv.exe (1368) The backup has been stopped because it was halted by the client or the connection with the client failed.

This problem occurs because the NTBackup utility refers to the backup information to obtain the file list. You expect the NTBackup utility to refer to the restore information to obtain the file list.

You can safely ignore this logged event. No problem actually occurs during the backup process. The backup process should be completed as expected in this situation. Additionally, you can successfully restore from the backup that is created by the NTBackup utility.

Microsoft has confirmed that this is a bug in the Microsoft products that are listed in the "Applies to" section.