Windows 10: Problem with VSS Error: Unexpected failure: The specified service does not exist as an...

We have recently taken on a new client that was the victim of ransomware. The IR team did data recovery but they left Robocopy script copy to USB as a backup solution which left me scratching my head. After trying to install a proper backup software, I can see why... The VSS is completely wrecked and I have spend the better part of a day trying to get it running in order to get our backup software to work. It's a small org with a single Windows 2025 server so reformatting/reinstalling is not a good option. I prefer to fix the VSS.The SWPRV service is present bu the VSS service is missing from

:)

 

VSS Subsystem is broken

The VSS Subsystem seems to be broken for me on my PC. Things which are fine:

1. The filesystem aka CHKDSK, SFC and DSIM. Everything is good.

2. VSSADMIN LIST PROVIDERS shows only 'Microsoft Software Shadow Copy provider 1.0'

3. VSSADMIN LIST WRITERS shows around 12 providers all 'Stable' and 'No error'

4. VSSADMIN LIST VOLUMES shows 4 volumes, one for each of my drives, as expected

5. The associated services (Microsoft Shadow Copy Provider) are running fine.

6 The System Volume Information folders are present, but well-hidden in Windows 11. If I try and create this folder, Windows complains as expected.

Things which are not fine:

1. VSSADMIN LIST SHADOWS results in 'Error: The shadow copy provider had an error. Please see the system and application event logs for more information'

2. Many many errors in the Application Event Log: Volume Shadow Copy Service error: Unexpected error IOCTL Unpack overflow. hr = 0x8000ffff, Catastrophic failure

also

Volume Shadow Copy Service error: Unexpected error calling routine Output buffer overflow. Reading bad arguments. dwSize = 8. hr = 0x8000ffff, Catastrophic failure

3. Any attempt to create a restore point: 'The shadow copy provider had an error. Check the system and application event logs for more information (0x80042306)

So, VSS is broken and non-functional somehow and I have no idea how to correct this. Anyone got a smarter idea than 'reinstall windows'? The IOCTL Unpack Overflow sounds very much like a driver versioning mismatch problem but I suspect only the dev who wrote it knows....

 

VSS Not funtioning properly

I am unable to get the VSS process to work properly. I get this report from Acronis:

1. Some disks may be overloaded. VSS may behave incorrectly under such conditions. Stop heavy operations or wait until completion.



2. Volume Shadow Copy Service warning: VSS was denied access to the root of volume \\?\Volume{b7539be4-7c73-49fa-ad9a-1286516a36f9}\. Denying administrators from accessing volume roots can cause many unexpected failures, and will prevent VSS from functioning
properly. Check security on the volume, and try the operation again.



3. Volume Shadow Copy Service warning: VSS was denied access to the root of volume \\?\Volume{916bf754-8f26-42d2-aa29-5a823f4f1a81}\. Denying administrators from accessing volume roots can cause many unexpected failures, and will prevent VSS from functioning
properly. Check security on the volume, and try the operation again.



4. Volume Shadow Copy Service warning: VSS was denied access to the root of volume \\?\Volume{fefe103d-98ca-4fe1-af63-8be36a5978bd}\. Denying administrators from accessing volume roots can cause many unexpected failures, and will prevent VSS from functioning
properly. Check security on the volume, and try the operation again.

 

System Restore is not working because of Volume Shadow Copy service

Hi, whenever I try to create a new restore point, I get this error:

There was an unexpected error in the property page:

The Volume Shadow Copy service used by System Restore is not working. For more information view the event log. (0x81000202)

I use Windows 10 Pro (21H2). All windows updates are installed.

I don't have "Volume Shadow Copy" in the list of services, I only have "Microsoft Software Shadow Copy Provider" service (it is running). Also, I don't have the "Multimedia Audio Services", it is supposed to be required for "Volume Shadow Copy". Sound is working on my PC.

What I tried:

I don't have any antivirus or backup software installed.

In the event viewer I noticed these 3 error messages related to the "Volume Shadow Copy" service :

1. Volume Shadow Copy Service error: Unexpected error calling routine CoCreateInstance. hr = 0x80070424,

The specified service does not exist as an installed service.

Operation: Instantiating VSS server

2. Volume Shadow Copy Service information: The COM Server with CLSID {e579ab5f-1cc4-44b4-bed9-de0991ff0623} and name IVssCoordinatorEx2 cannot be started. [0x80070424, The specified service does not exist as an installed service.

]

Operation:

Instantiating VSS server

3. Volume Shadow Copy Service error: Unexpected error calling routine OpenService (shSCManager, 'VSS', SERVICE_QUERY_STATUS). hr = 0x80070424,

The specified service does not exist as an installed service.

.

Operation:

Initialize For Backup

When executing this command with admin rights: "vssadmin list writers", I get the following output:

What Can I do to make System Restore work?