⚑ Deus Ex Machina ➽ Eventlog Lookup

Deus Ex Machina » Eventlog » Event 8193 - VSS

VSS - 8193


Description »
Volume Shadow Copy Service error: Unexpected error calling routine RegSaveKeyExW.  hr = 0x800703f8.
Data formatted as » Bytes
- Code: WRTREGRC00000396 - Call: WRTREGRC00000318 - PID:  00002936 - TID:  00007948 - CMD:  C:\WINNT\System32\vssvc.exe      - U

The hresult of 0x800703f8 is equivalent to Win32 error 1016. This is defined as An I/O operation initiated by the registry failed unrecoverably. The registry could not read in, or write out, or flush, one of the files that contain the system's image of the registry. This is the same result as seen in Application Popup event ID 333.

If you're noticing paged pool leaks from tag MntA on Server 2003, install the hotfix from MS KB940307.

If you're using Windows 2003 and the hresult you're seeing is 0x80070057 (parameter is incorrect) or 0x800700ea (more data is available), take a look at MS KB833167, as this hotfix includes several VSS fixes for exactly those issues.

On Windows 2008 R2, you may see hresult 0x80070005 (access is denied), again when writing to the registry. If this is the case, you'll need to identify which user the VSS service is running as, and grant it permissions to the Services\VSS\Diag registry key. This seems to be needed when DHCP or SharePoint 2010 are added to the server.

If this is a Hyper-V server on Windows 2008 R2, and you have the App-V client installed - and the description of the error says "hr = 0x8000ffff, Catastrophic failure", you should consult MS KB2695888.

If the error is "Volume Shadow Copy Service error: Unexpected error calling routine CoCreateInstance. hr = 0x80070422", then your VSS service is disabled, and you almost certainly have event ID 39 telling you this.

If the error is "Unexpected error calling routing ConvertStringSidToSid(S-1-5-.....). hr = 0x80070539", then you probably have an invalid entry in the registry at HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList. See MS KB947242 for instructions on deleting profile keys from this location.