Volume Shadow Copy & NTBackup Broken

Failures with Volume Shadow Copy Service (VSS) and backups and how to fix

Here is the scenario: You upgraded a drive in your workstation or server and thought all was well. Except now your backup, taken with either NTBackup or some other tool that utilizes the Windows Shadow Copy Service is failing to back up any of your data. In fact, the service itself is failing miserably.

Don't panic, and don't spend hours searching around. Been there, done that, including turning on all the registry keys that lets the volume shadow copy service trace its every move to a trace log file.

Quote
Click Here for Press Release

So what happened?

That depends on just how you upgraded your drive. In my case, I used an imaging utility. There are many available on the market. This one happened to be Acronis, as provided by the Seagate Software Sea Tools disk that came with an internal hard drive.

However, this problem isn't limited to Acronis. If you used Kaseya's upgrading utility, that also uses Acronis. Or if you used Norton's Ghost, or the unix / linux dd command, or any of a whole host of other utilities chances are shadow copy is now broken.

While these utilities are great at copying your data, not all of them are aware of the shadow copy data itself. The old drive has that data, your new copy doesn't. But your system THINKS your new drive has that shadow copy data, and that is why it is now crapping out. If you already know this is your problem, you can click here to jump right to the end and the solution. There are probably some that are shadow copy friendly. But if you used one of those, you probably aren't reading this article. The stuff in between here and the answer are other symptoms of the same error, primarily here so the search engines will hopefully help you get to this page if you happen to experience the same problem. But you might find it helpful to verify you are having the same problem I did, too.

Symptoms of the crash

Here are some relevant events from the event log that are evidence that your problem is described here. I've included screen shots of the event log as well as the text as copied from the copy event to clipboard button. These came from an SBS 2003 Premium server. If someone finds similar but slightly different errors from a Server 2003 or Server 2008 system, if you'd be so kind as to forward me some screen shots and the copied text of those errors I'll incorporate those here as well to make this easier for others to find and thus fix.

One of the error messages I got was:

Error returned while creating the volume shadow copy:0x8004230f.

That appears to be a rather generic error message for many different failures. However, going into the event logs I found these messages:

VSS Volume Shadow Copy Event ID: 12293

Event Type: Error
Event Source:     VSS
Event Category:   None
Event ID:   12293
Date:       4/4/2009
Time:       2:40:32 PM
User:       N/A
Computer:   EDISERVER
Description:
Volume Shadow Copy Service error: Error calling a routine on the Shadow Copy Provider 
{b5946137-7b9f-4925-af80-51abd60b20d5}. Routine details 
IVssSnapshotProvider::QueryVolumesSupportedForSnapshots(ProviderId,29,...) [hr = 0x8000ffff].
 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 2d 20 43 6f 64 65 3a 20   - Code: 
0008: 43 4f 52 4d 47 4d 54 43   CORMGMTC
0010: 30 30 30 30 30 33 32 34   00000324
0018: 2d 20 43 61 6c 6c 3a 20   - Call: 
0020: 43 4f 52 4d 47 4d 54 43   CORMGMTC
0028: 30 30 30 30 30 32 38 30   00000280
0030: 2d 20 50 49 44 3a 20 20   - PID:  
0038: 30 30 30 30 35 36 31 36   00005616
0040: 2d 20 54 49 44 3a 20 20   - TID:  
0048: 30 30 30 30 35 39 30 30   00005900
0050: 2d 20 43 4d 44 3a 20 20   - CMD:  
0058: 43 3a 5c 57 49 4e 44 4f   C:\WINDO
0060: 57 53 5c 53 79 73 74 65   WS\Syste
0068: 6d 33 32 5c 76 73 73 76   m32\vssv
0070: 63 2e 65 78 65 20 20 20   c.exe   
0078: 2d 20 55 73 65 72 3a 20   - User: 
0080: 4e 54 20 41 55 54 48 4f   NT AUTHO
0088: 52 49 54 59 5c 53 59 53   RITY\SYS
0090: 54 45 4d 20 20 20 20 20   TEM     
0098: 2d 20 53 69 64 3a 20 20   - Sid:  
00a0: 53 2d 31 2d 35 2d 31 38   S-1-5-18

Event Type: Error
Event Source:     VSS
Event Category:   None
Event ID:   12293
Date:       4/4/2009
Time:       1:59:59 PM
User:       N/A
Computer:   EDISERVER
Description:
Volume Shadow Copy Service error: Error calling a routine on the Shadow Copy Provider 
{b5946137-7b9f-4925-af80-51abd60b20d5}. Routine details Cannot ask provider 
{b5946137-7b9f-4925-af80-51abd60b20d5} if volume is supported. [0x8000ffff] [hr = 0x8000ffff].
 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 2d 20 43 6f 64 65 3a 20   - Code: 
0008: 43 4f 52 43 4f 4f 52 43   CORCOORC
0010: 30 30 30 30 31 38 35 33   00001853
0018: 2d 20 43 61 6c 6c 3a 20   - Call: 
0020: 43 4f 52 43 4f 4f 52 43   CORCOORC
0028: 30 30 30 30 31 37 36 35   00001765
0030: 2d 20 50 49 44 3a 20 20   - PID:  
0038: 30 30 30 30 35 33 39 36   00005396
0040: 2d 20 54 49 44 3a 20 20   - TID:  
0048: 30 30 30 30 35 34 32 30   00005420
0050: 2d 20 43 4d 44 3a 20 20   - CMD:  
0058: 43 3a 5c 57 49 4e 44 4f   C:\WINDO
0060: 57 53 5c 53 79 73 74 65   WS\Syste
0068: 6d 33 32 5c 76 73 73 76   m32\vssv
0070: 63 2e 65 78 65 20 20 20   c.exe   
0078: 2d 20 55 73 65 72 3a 20   - User: 
0080: 4e 54 20 41 55 54 48 4f   NT AUTHO
0088: 52 49 54 59 5c 53 59 53   RITY\SYS
0090: 54 45 4d 20 20 20 20 20   TEM     
0098: 2d 20 53 69 64 3a 20 20   - Sid:  
00a0: 53 2d 31 2d 35 2d 31 38   S-1-5-18

Event Type: Error
Event Source:     NTBackup
Event Category:   None
Event ID:   8019
Date:       4/4/2009
Time:       1:59:59 PM
User:       N/A
Computer:   EDISERVER
Description:
End Operation: Warnings or errors were encountered. 
Consult the backup report for more details.
 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

This was a useless error message help text from Microsoft that comes up when I hit one of the "For more information, see Help and Support Center at..." links. Click the thumbnail for a larger image, but I'm sure you've seen useless messages like this before.

Enough with what happened - show me the fix already!

My chosen fix path was to change the "Volume ID" of that newly imaged disk.

I used MBRWizard which you can download here.

Running that on the system in question, I used the command:

mbrwiz /signature

to identify the disk signature of the current drive. Then I changed the number slightly and wrote it back with:

mbrwiz /signature=<slightly altered signature from above>

Rebooted and all was well again with volume shadow copy!

If you found this helpful or not, please send me a brief email -- one line will more than do. If I saved you a bunch of time (and thus $$), and you wanted to show appreciation, sending a little love via PayPal or an Amazon gift card is also very much appreciated!

I can be reached at:

das (at-sign) dascomputerconsultants (dot) com

Enjoy!

David Soussan
(C) 2009 DAS Computer Consultants, LTD. All Rights Reserved.

Everything below this line is to help search engines find, index, and thus help users find this content.

8004230f
0x8004230f
EventID: 12293
Event ID: 12293

Failed to retrieve volumes that are eligible for shadow copies.

Error 0x8004230f: The shadow copy provider had an unexpected error while trying to process the specified operation.
Application Event Log:
Event Type:       Error
Event Source:    VSS
Event Category: None
Event ID:           12293
Description: Volume Shadow Copy Service error: Error calling a routine on the Shadow Copy Provider {b5946137-7b9f-4925-af80-51abd60b20d5}. Routine details IVssSnapshotProvider::QueryVolumesSupportedForSnapshots(ProviderId,29,...) [hr = 0x8000ffff].