Troubleshooting VSS errors

The Volume Shadow Copy Service (VSS) is a core component of Windows that lets backup operators protect a Windows system while it is running.
When VSS does not operate properly, it produces specific errors that Endpoint Backup v2 collects and displays, logs events in Windows Event Viewer, and causes the backup to fail.
This article explains how to identify the VSS errors, work through their common causes, and gather the diagnostic data Microsoft needs if the problem is inside Windows itself.

Some VSS failures are transient and clear on their own.
Others point to improper deployment or configuration of the Windows operating system or its applications, and a few indicate damage severe enough to require a rollback to a known-good state, disaster recovery, or a complete server rebuild.

IMPORTANT  Endpoint Backup v2 does not cause VSS errors, although attempting a snapshot is often what reveals them.
VSS is a Microsoft component, and no code or settings changes in Endpoint Backup v2 or its agent can resolve a VSS failure.
You resolve these errors by repairing the operating system or addressing the underlying infrastructure.

NOTE  Restarting the VSS services or Windows itself will often clear a VSS error temporarily.
If the underlying condition that caused the failure recurs, the error will also recur.

Symptoms

One or more of the following occur while protecting a Windows system:

  • A backup of a Windows asset fails, and Endpoint Backup v2 reports a VSS error code, usually beginning with 0x8.
  • Windows records VSS and VolSnap error events in the Application and System event logs at the time of the failure.
  • Running vssadmin list writers returns one or more writers in a failed or unstable state.
  • The Shadow Copies tab in disk properties fails to load.

Causes

VSS failures have a wide range of root causes. The most common are the following:

  • A transient condition on the server, such as a busy volume, a concurrent snapshot operation, or a backup that started while another backup product was running.
  • Windows updates, drivers, or application installations that did not complete successfully, or that completed but are still waiting on a reboot.
  • Improper deployment or configuration of the Windows operating system or the applications running on it, including clusters that do not follow Microsoft best practices.
  • Third-party backup software or SAN hardware VSS providers competing with the Microsoft provider.
  • Insufficient shadow copy storage or free disk space on the volumes being protected.
  • File system corruption on one or more volumes.
  • Catastrophic damage to Windows that requires a rollback to a prior known-good state, disaster recovery, or a complete server rebuild.

VSS error codes

The following table lists common VSS error codes with their most frequent root causes and suggested guidance.
Neither the list of codes nor the guidance is exhaustive, and Endpoint Backup v2 may not encounter every code shown.

TIP  The most effective way to troubleshoot a VSS error is to search online for the 0x8 hex code together with the related Windows event IDs from your event logs.

Error and code Description, common causes, and guidance
VSS_E_BAD_STATE
0x80042301		 A function call was made when the object was in an incorrect state. Indicates the Microsoft VSS framework or some VSS writers are in a bad state. A reboot may resolve the error temporarily, but the condition may also be caused by raw volumes present on the server in an offline state. It may be prevalent on cluster shared volume (CSV) storage that is not deployed to Microsoft standards.
VSS_E_UNEXPECTED
0x80042302		 A VSS component encountered an unexpected error. This is typically associated with file system damage. Run chkdsk /F on the impacted volumes, followed by System File Checker (SFC) and Deployment Image Servicing and Management (DISM) scans.
VSS_E_PROVIDER_NOT_REGISTERED
0x80042304		 The volume shadow copy provider is not registered on the system. This is resolved only by registry repair. The Shadow Copies tab in disk properties will also fail to load.
VSS_E_PROVIDER_VETO
0x80042306		 Windows explicitly rejected performing a shadow copy at this time. This error can be transient. Ensure that no other backup providers are installed, that the volume being backed up has sufficient snapshot space, and that multiple backup types are not in use for the same server.
VSS_E_PROVIDER_IN_USE
0x80042307		 The shadow copy provider is in use and cannot be unregistered. This is commonly seen in virtual machine (VM) backups where the host cannot quiesce the guest. Verify that no third-party backup software is installed and that no other backups or Windows updates run during VM backups. Review the in-guest Windows event logs for further troubleshooting.
VSS_E_OBJECT_NOT_FOUND
0x80042308		 The specified object was not found. Microsoft VSS failed to take a snapshot, so the job cannot back up files opened exclusively by other applications. This is most commonly caused by VSS being disabled on one or more volumes in the backup, or by an issue with VSS DLL registration.
VSS_S_ASYNC_PENDING
0x00042309		 The asynchronous operation is pending. This is common on database servers where other critical operations run concurrently with the backup.
VSS_S_ASYNC_FINISHED
0x0004230A		 The asynchronous operation has completed.
VSS_S_ASYNC_CANCELLED
0x0004230B		 The asynchronous operation has been canceled.
VSS_E_VOLUME_NOT_SUPPORTED
0x8004230C		 Shadow copying the specified volume is not supported. This may indicate that shadow copies have been disabled on a volume that should support them. Check the shadow copy settings for the volumes on the server.
VSS_E_OBJECT_ALREADY_EXISTS
0x8004230D		 The object already exists. This usually indicates the presence of non-Microsoft shadow copy providers. Removing third-party backup software products other than Datto Endpoint Backup typically resolves the issue.
VSS_E_VOLUME_NOT_SUPPORTED_BY_PROVIDER
0x8004230E		 The given shadow copy provider does not support shadow copying the specified volume. This usually indicates the presence of non-Microsoft shadow copy providers. Removing third-party backup software products other than Datto Endpoint Backup typically resolves the issue.
VSS_E_UNEXPECTED_PROVIDER_ERROR
0x8004230F		 The shadow copy provider had an unexpected error while processing the operation. This usually indicates the presence of non-Microsoft shadow copy providers. Removing third-party backup software products other than Datto Endpoint Backup typically resolves the issue.
VSS_E_CORRUPT_XML_DOCUMENT
0x80042310		 The given XML document is invalid, either incorrectly formed or not matching the schema. This is commonly associated with running or failed Windows updates. Ensure that updates and any driver or application installations completed successfully and that Windows is in a clean reboot state.
VSS_E_INVALID_XML_DOCUMENT
0x80042311		 The given XML document is invalid, either incorrectly formed or not matching the schema. This is commonly associated with running or failed Windows updates. Ensure that updates and any driver or application installations completed successfully and that Windows is in a clean reboot state.
VSS_E_MAXIMUM_NUMBER_OF_VOLUMES_REACHED
0x80042312		 The maximum number of volumes for this operation has been reached. This state is potentially unsafe, because older shadow copies are not being removed properly. It may be caused by antivirus scanning interrupting operations, use of multiple backup products, incomplete Windows updates, or backups that are too frequent for the available resources. Safely remove stale snapshots and determine why they are hanging.
VSS_E_FLUSH_WRITES_TIMEOUT
0x80042313		 The provider timed out while flushing data to the volume being shadow copied, probably because of excessive volume activity. Retry when the volume is less busy. This error is more common on systems with limited resources or slow disks.
VSS_E_HOLD_WRITES_TIMEOUT
0x80042314		 The provider timed out while holding writes to the volume being shadow copied, probably because of excessive activity from an application or system service. Retry when activity is reduced. This error is more common on systems with limited resources or slow disks.
VSS_E_UNEXPECTED_WRITER_ERROR
0x80042315		 VSS encountered problems sending events to writers. This may occur if other backup products are installed, if multiple shadow copies are created or consolidated concurrently, or if backups run too frequently without giving Windows time to clean up after a prior job. It can also relate to limited server resources.
VSS_E_SNAPSHOT_SET_IN_PROGRESS
0x80042316		 Another shadow copy creation is already in progress. Wait and retry. Ensure that no other backup products are installed, that multiple backup types are not attempted for the same server, and that backups are not too frequent for the available resources.
VSS_E_MAXIMUM_NUMBER_OF_SNAPSHOTS_REACHED
0x80042317		 The volume has reached its maximum number of shadow copies and was not added to the shadow copy set. Other possible causes are insufficient free disk space where the locked file resides, or another product already using the shadow copy volume. Restart the server and retry.
VSS_E_WRITER_INFRASTRUCTURE
0x80042318		 An error was detected while contacting VSS writers. This typically requires ensuring that the default Microsoft system writer is forced. It is commonly seen when other backup providers are installed.
VSS_E_WRITER_NOT_RESPONDING
0x80042319		 A writer did not respond to a GatherWriterStatus call. The writer may have terminated or become stuck. This is commonly caused by disk corruption, which you can check by running chkdsk /F, or by limited free space for shadow copies.
VSS_E_WRITER_ALREADY_SUBSCRIBED
0x8004231A		 The writer already called Subscribe and cannot call it multiple times. Backups may be scheduled too frequently, or multiple backup types are being attempted concurrently.
VSS_E_UNSUPPORTED_CONTEXT
0x8004231B		 The provider does not support the specified shadow copy type. The shadow copy space on the volume may be too small, or it may be redirected to an alternate volume that is not part of the backup scope or does not support VSS operations.
VSS_E_VOLUME_IN_USE
0x8004231D		 The specified shadow copy storage association is in use and cannot be deleted. This may occur if shadow copies were in use when the volume was added to a cluster, if the volume failed over with a shadow copy in use, or if another system sharing the disk has its own snapshot in use. Manual snapshot removal is often required.
VSS_E_MAXIMUM_DIFFAREA_ASSOCIATIONS_REACHED
0x8004231E		 The maximum number of shadow copy storage associations has been reached. Ensure that multiple backups are not in use and that third-party software is uninstalled. Remove existing snapshots and assess the snapshot storage space.
VSS_E_INSUFFICIENT_STORAGE
0x8004231F		 There is insufficient storage to create the shadow copy storage file or other shadow copy data. Reassess snapshot storage use and delete stale snapshots. This is common when volumes have less than the 10% free space that Microsoft recommends.
VSS_E_UNSELECTED_VOLUME
0x8004232A		 The operation would overwrite a volume that was not explicitly selected. Check the Application event log. This error may persist in environments where volume synchronization, clustering, or Active Directory Federation Services (AD FS) are not functioning properly.
VSS_E_SNAPSHOT_NOT_IN_SET
0x8004232B		 The shadow copy ID was not found in the backup components document for the set. This indicates a functional failure in Windows managing its own shadow copies. Removing stale shadow copies may be required.
VSS_E_NESTED_VOLUME_LIMIT
0x8004232C		 The specified volume is nested too deeply to participate in the VSS operation. This occurs on a Hyper-V host-level backup where a VM's internal operating system has mounted a VHD or VHDX directly through Disk Management that is part of storage the host operating system is snapshotting. Instead, use Hyper-V to connect the VHD to the VM from the host level.
VSS_E_VOLUME_NOT_LOCAL
0x8004232D		 The volume being backed up is not mounted on the local host. This can occur when backing up a VM that is part of a cluster, or when a cluster volume in a backup fails over to another host after the backup starts. It may also occur with iSCSI or Fibre Channel mounts where the storage system uses third-party VSS providers. Refer to the best practices for protecting cluster resources.
VSS_E_CLUSTER_TIMEOUT
0x8004232E		 A timeout occurred while preparing a cluster shared volume for backup. This commonly occurs when the cluster configuration does not meet Microsoft requirements or best practices. Ensure that you use the correct backup type for your cluster and that you protect the cluster through the active node. It is commonly seen on Hyper-V clusters where guests from different hosts share the same CSV, which must be corrected.
VSS_E_NOT_SUPPORTED
0x8004232F		 The requested operation is not supported. This indicates that the disk, or critical objects on it, are excluded from VSS through the registry but were included in a backup. It may be seen on third-party database servers and usually indicates that direct backup of the application cannot be supported and will require third-party tools to protect.
VSS_E_WRITERERROR_PARTIAL_FAILURE
0x80042336		 The writer experienced a partial failure. Check the component-level error state. This error is produced by the Hyper-V VSS writer and typically indicates that a VM prevented the snapshot, commonly when migrating between storage owned by a different VM host, or where CSV cluster architecture best practices and VM separation have not been followed.
VSS_E_CLUSTER_ERROR
0x80042400		 The clustered disks could not be enumerated or put into cluster maintenance mode. Check the System event log for cluster events and the Application event log for VSS events.
VSS_E_WRITER_STATUS_NOT_AVAILABLE
0x80042409		 Writer status is not available for one or more writers. A writer may have reached the limit of available backup and restore session states. Ensure that backups are not too frequent and that multiple backup types are not in use. This is common on SQL and Hyper-V servers with multiple parallel backups and in clusters. Limit the number of concurrent backups that run against a cluster.
VSS_E_WRITERERROR_INCONSISTENTSNAPSHOT
0x800423F0		 The shadow copy set contains only a subset of the volumes needed to back up the selected writer components. This can occur when backing up certain SharePoint farm servers, especially after updates. System state backups of farm servers are not viable for recovery, and VM or image backups of SharePoint are not supported. For non-SharePoint servers, this may also indicate file system corruption.
VSS_E_WRITERERROR_OUTOFRESOURCES
0x800423F1		 A resource allocation failed because Windows ran out of memory. Reassess the server requirements and ensure that applications are not leaking memory or hanging. A reboot is a short-term resolution only.
VSS_E_WRITERERROR_TIMEOUT
0x800423F2		 The writer's timeout expired between the Freeze and Thaw events. This is typically not seen on patched servers but was an issue on unpatched servers in the past. It can occur if the Security Accounts Manager (SAM) registry writer has pending tasks during snapshot consolidation at the end of a backup.
VSS_E_WRITERERROR_RETRYABLE
0x800423F3		 The writer experienced a transient error that may not recur on retry. Common causes are non-responsive Universal Serial Bus (USB) volumes, a very large number of volumes to snapshot, many SQL databases on a single volume, insufficient Windows resources (especially low I/O performance), concurrent snapshot operations from other backups, backups that are too frequent, backups and Windows updates running concurrently, or clusters that are not deployed to Microsoft best practices. Architectural changes are commonly required for a permanent fix, and a reboot may resolve the error temporarily. Datto Endpoint Backup most commonly sees this error on Hyper-V host clusters that do not follow Microsoft deployment guidelines. On Hyper-V clusters, run the Best Practices Analyzer with the storage option, which requires the VMs to be turned off, and review the results.
VSS_E_WRITERERROR_NONRETRYABLE
0x800423F4		 The writer experienced a non-transient error that is likely to recur on retry. This is commonly caused by SQL VSS or Hyper-V VSS issues and requires a reboot. It is often the result of incomplete Windows updates or multiple conflicting backup types. It may also be caused by insufficient resources, a failing Microsoft Entra ID sync, or cluster nodes that are not in a healthy sync state.
VSS_E_WRITERERROR_RECOVERY_FAILED
0x800423F5		 The writer failed while trying to recover the shadow copy volume. This can be caused by Windows resource overuse or conflicting backup providers. Ensure that no other backup software is installed and that multiple backups of the same machine are not in use.
VSS_E_LEGACY_PROVIDER
0x800423F7		 This version of the hardware provider does not support this operation. Storage area network (SAN) vendors often add hardware VSS providers. Ensure that you are not using SAN snapshot technology in addition to backups and that the SAN drivers are current.
VSS_E_MISSING_DISK
0x800423F8		 An expected disk did not arrive in the system. Ensure that a disk present at backup initiation remains connected through the entire operation. Some IP KVM systems provide passthrough storage that appears as a local rather than a removable disk. This error can also occur when a cluster has not cleanly failed over, which requires a failover and failback or a full cluster restart.
VSS_E_MISSING_HIDDEN_VOLUME
0x800423F9		 An expected hidden volume did not arrive. Check the Application event log. This is a defect in Windows Server 2019 and newer that has been patched by Microsoft, and it is typically seen during VM backups of Windows Server 2019 guests. Update Windows to resolve it. A similar defect existed in Hyper-V 2012 and 2016 clusters.
VSS_E_MISSING_VOLUME
0x800423FA		 An expected volume did not arrive. Check the Application event log. This may be seen with clusters in an unhealthy state, offline disks, or drives using low power states that fail to respond within Windows.
VSS_E_KEY_DELETED
0x800703FA		 An illegal operation was attempted on a registry key that is marked for deletion.
VSS_E_DYNAMIC_DISK_ERROR
0x800423FC		 An error occurred processing the dynamic disks involved. Dynamic disks are deprecated by Microsoft and should not be used except for operating system disk mirroring. Dynamic disk boot mirrors prevent server recovery through bare metal restore, Windows replicas, and instant recovery. As a best practice, any server with dynamic disks should be rebuilt without that configuration.

NOTE  Support can research native Microsoft errors to help determine potential root causes, but there are limits to how far Support can troubleshoot faults inside Windows itself. Where an issue is not easily resolved, Support will typically recommend engaging Microsoft. In those cases, Endpoint Backup v2 provides access to a senior engineer who will join third-party calls to Microsoft that you initiate, to help accelerate resolution.

Resolution steps

Many writer-related VSS issues clear after a controlled restart of the VSS service and the affected writer. To resolve this issue, complete the following steps:

  1. Ensure that no backups or restores are running. No backup agent backup or restore processes should be active in Windows.
  2. If you are performing a VM backup, ensure that no VM snapshots are present, that the VM is not currently migrating to alternate storage, and that VM and in-guest backups are not both scheduled.
  3. Stop the impacted VSS writer service in Windows, for example, the SQL VSS Writer.
  4. Stop the VSS core service.
  5. Wait 30 seconds.
  6. Start the VSS service.
  7. Start the impacted VSS writer service.
  8. Run the command vssadmin list writers.
  9. Verify whether the writer reports any errors.
  10. Reattempt the backup operation.
  11. If errors occur, check the System and Application event logs for VSS and writer error and warning events, and attempt to remediate them.
  12. If errors persist, reboot the operating system and retry steps 8 through 11.

If the writer reports no errors and the backup completes, the issue is resolved.

NOTE  If the error returns on the next scheduled backup, the underlying condition is still present. Use the VSS error codes table to identify the specific code, then work through Tips and tricks.

Tips and tricks

Keep Windows patched and rebooted

Endpoint Backup v2 assumes that you have applied all currently available Windows patches and relevant hotfixes to your servers.
This includes updates for Microsoft applications such as SQL Server and Exchange, as well as manufacturer drivers.
After Windows updates run, it is critical to reboot if any of the fixes require it.

Because administrators commonly apply Windows updates without rebooting, this is the single largest reason that a simple reboot appears to resolve most VSS errors.
A VSS error that clears on reboot is often a sign that you are not managing Windows updates and reboots properly.

Control the VSS diff area size

If either of the following events occurs after you apply the fixes above, reduce the I/O load on the system to avoid the problem in the future:

  • “The shadow copy of volume C: took too long to install”
  • “The shadow copy of volume C: was aborted because the diff area file could not grow in time”

If the events continue to occur, use the following registry value to control the size of the diff area that VSS uses:

Attribute Value
Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VolSnap\MinDiffAreaFileSize
Type REG_DWORD
Default 300
Range 300 to 3000

Keep event logs under 64 MB

Microsoft advises that if the event logs are sufficiently large, the copy operation can take longer than the timeout on systems under high I/O or high memory load.
Microsoft recommends keeping event logs below 64 MB.

Collect diagnostic information for Microsoft

When Support determines that a VSS failure is outside the scope of the Endpoint Backup v2 Windows agent, gather the following information for Microsoft support to examine:

  • Windows Application event log
  • Windows System event log
  • VSS trace

Endpoint Backup v2 senior engineers will join calls that you make to Microsoft on request.
Kaseya cannot initiate these calls on your behalf, but you will not have to deal with Microsoft support alone.

Event logs

Examine the Application and System event logs, focusing on the error events created by the VolSnap and VSS sources at the time of the failure.
Extracting the relevant events from the log helps isolate the problem and makes for a more productive interaction with Microsoft support.

Perform a VSS trace

vsstrace is a tool that Microsoft provides as part of the Windows Software Development Kit (SDK).
It is an advanced tool used for VSS data collection alongside Microsoft senior support when investigating Windows defects or damage.
Endpoint Backup v2 does not use this tool or its data, but Kaseya recommends collecting it if Support advises you to engage Microsoft to determine the nature of your VSS errors.

You must install the SDK before you can use vsstrace. For more information, refer to the following Microsoft resources:

Diagnose I/O performance

Use the Microsoft I/O performance tools to gather data for analysis, and check disk defragmentation.
The Endpoint Backup v2 Windows agent uses the VSS interface to read SQL data from disk.
If there is a problem with the VSS SQL writer, use vssadmin.exe to confirm that the SQL writer is available on the system.

Related articles