Event ID 21 — Volume Shadow Copy Service Operations

Applies To: Windows Server 2008

The Volume Shadow Copy Service (VSS) provides the ability to create a point in time image (shadow copy) of one or more volumes that can be used to perform backups. The service is also used during restores of applications.

Event Details

Resolve

Perform a system state restore

Possible resolutions include:

• Perform a system state restore of the operating system using your computer's backup program. For more information, see the documentation for the backup program.
• Perform a system state restore of the operating system from the command line. For more information, see "Recover the system state using the command line."
• Reinstall Windows to restore and reregister all COM+ components.
• Contact Microsoft Customer Service and Support. For more information, see https://go.microsoft.com/fwlink/?LinkId=102491. You should provide the entire event log message as it appears in the Event Viewer. If you do not currently have Event Viewer open, see "Open Event Viewer and view events related to Volume Shadow Copy Service (VSS)."

To perform these procedures, you must have membership in Administrators, or you must have been delegated the appropriate authority.

Recover the system state using the command line

Note: If you are using BitLocker Drive Encryption to protect your server and you need to perform a system state recovery, make sure to reapply BitLocker Drive Encryption. This will not happen automatically—it must be enabled explicitly. For instructions, see the Windows BitLocker Drive Encryption Step-by-Step Guide (https://go.microsoft.com/fwlink/?LinkId=93107).

To recover the system state by using the command line:

1. Open an elevated Command Prompt window. Click Start, point to All Programs, click Accessories, right-click Command Prompt, and then click Run as administrator.

2. At the prompt, type: wbadmin start systemstaterecovery. Use parameters, as needed. (To view the parameters and help for this command, at a command line, type: wbadmin start backup /?.)

   For example, to run a system state recovery of the backup from 04/30/2005 at 9:00 A.M. that is stored on the shared resource \\servername\share for server01, type: wbadmin start systemstaterecovery -version:04/30/2005-09:00 -backupTarget:\\servername\share -machine:server01.

   For more information about wbadmin start systemstaterecovery, see https://go.microsoft.com/fwlink/?LinkId=105282.

Open Event Viewer and view events related to Volume Shadow Copy Service (VSS)

To open Event Viewer and view events related to VSS:

1. If Server Manager is not already open, click Start, click Administrative Tools, and then click Server Manager.
2. In the console tree, expand Diagnostics, expand Event Viewer, expand Windows Logs, and then click Application.
3. To filter the events so that only events with a Source of VSS are shown, in the Actions pane, click Filter Current Log. On the Filter tab, in the Event sources drop-down list, select the checkbox for VSS. Select other options as appropriate, and then click OK.
4. To sort the displayed events by date and time, in the center pane, click the Date and Time heading.

Verify

To perform this procedure, you must have membership in Administrators, or you must have been delegated the appropriate authority.

To verify that the Volume Shadow Copy Service is started:

1. Click Start, point to Administrative Tools, and then click Services.
2. In the results pane, double-click Volume Shadow Copy.
3. In Service status, make sure that the status is Started. If the status is not Started, click Start.
4. Make sure Startup type is set to Manual.
5. Click OK.

Related Management Information

Volume Shadow Copy Service Operations

File Services