Windows 10: Cannot make system image - VSS error 12289

Whenever I try to create a system image or run recimg I get error 12289 and the backup fails. System protection is turned on and maximum space used is set to 20%. I have no third party backup software installed and this is a real not virtual machine.

PHP Code: <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
<Provider Name="VSS" />
<EventID Qualifiers="0">12289</EventID>
<Level>2</Level>
<Task>0</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2015-03-09T21:01:50.000000000Z" />
<EventRecordID>3255</EventRecordID>
<Channel>Application</Channel>
<Computer>Windows10</Computer>
<Security />
</System>
- <EventData>
<Data>CreateFileW(\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy23\,0x80000000,0x00000003,...)</Data>
<Data>0x80070001, Incorrect function.</Data>
<Data>Operation: Processing PreFinalCommitSnapshots Context: Execution Context: System Provider</Data>
<Binary>2D20436F64653A20494E434943484C4830303030303237302D2043616C6C3A2053505251534E504330303030303331302D205049443A202030303031333930302D205449443A202030303030373533362D20434D443A2020433A5C57696E646F77735C53797374656D33325C737663686F73742E657865202D6B2073777072762D20557365723A204E616D653A204E5420415554484F524954595C53595354454D2C205349443A532D312D352D313820</Binary>
</EventData>
</Event>
The provider looks OK but various writers are timing out.

PHP Code: C:\Windows\system32>vssadmin list providers
vssadmin 1.1 - Volume Shadow Copy Service administrative command-line tool
(C) Copyright 2001-2013 Microsoft Corp.

Provider name: 'Microsoft Software Shadow Copy provider 1.0'
Provider type: System
Provider Id: {b5946137-7b9f-4925-af80-51abd60b20d5}
Version: 1.0.0.7


C:\Windows\system32>vssadmin list writers
vssadmin 1.1 - Volume Shadow Copy Service administrative command-line tool
(C) Copyright 2001-2013 Microsoft Corp.

Writer name: 'Task Scheduler Writer'
Writer Id: {d61d61c8-d73a-4eee-8cdd-f6f9786b7124}
Writer Instance Id: {1bddd48e-5052-49db-9b07-b96f96727e6b}
State: [1] Stable
Last error: No error

Writer name: 'VSS Metadata Store Writer'
Writer Id: {75dfb225-e2e4-4d39-9ac9-ffaff65ddf06}
Writer Instance Id: {088e7a7d-09a8-4cc6-a609-ad90e75ddc93}
State: [1] Stable
Last error: No error

Writer name: 'Performance Counters Writer'
Writer Id: {0bada1de-01a9-4625-8278-69e735f39dd2}
Writer Instance Id: {f0086dda-9efc-47c5-8eb6-a944c3d09381}
State: [1] Stable
Last error: No error

Writer name: 'System Writer'
Writer Id: {e8132975-6f93-4464-a53e-1050253ae220}
Writer Instance Id: {92ac01cb-2000-4c26-8716-36d1aef10cb0}
State: [10] Failed
Last error: Timed out

Writer name: 'ASR Writer'
Writer Id: {be000cbe-11fe-4426-9c58-531aa6355fc4}
Writer Instance Id: {4e0a37e2-32a7-4e85-857c-4a1565bb7fba}
State: [1] Stable
Last error: No error

Writer name: 'Shadow Copy Optimization Writer'
Writer Id: {4dc3bdd4-ab48-4d07-adb0-3bee2926fd7f}
Writer Instance Id: {97659c74-4a8e-4a36-89a2-87e2c573bdf6}
State: [1] Stable
Last error: No error

Writer name: 'Registry Writer'
Writer Id: {afbab4a2-367d-4d15-a586-71dbb18f8485}
Writer Instance Id: {48a27a8a-2ee7-4acb-9be8-2396afa8c83d}
State: [1] Stable
Last error: No error

Writer name: 'MSSearch Service Writer'
Writer Id: {cd3f2362-8bef-46c7-9181-d62844cdc0b2}
Writer Instance Id: {0c0f1392-ed06-4429-a2d6-77e775bd4324}
State: [10] Failed
Last error: Timed out

Writer name: 'COM+ REGDB Writer'
Writer Id: {542da469-d3e1-473c-9f4f-7847f01fc64f}
Writer Instance Id: {f89f31e7-5f24-45ea-85bb-1fe7653a733a}
State: [1] Stable
Last error: No error

Writer name: 'BITS Writer'
Writer Id: {4969d978-be47-48b0-b100-f328f07ac1e0}
Writer Instance Id: {993cb077-fa7a-49e8-b451-09684623c941}
State: [1] Stable
Last error: No error

Writer name: 'WMI Writer'
Writer Id: {a6ad56c2-b509-4e6c-bb19-49d8f43532f0}
Writer Instance Id: {f75fda76-14cd-40d3-a0b4-6d5765354016}
State: [10] Failed
Last error: Timed out


C:\Windows\system32>
What I've tried:

• Fixed CAPI2 error using this command (updated for windows 10 based on Event 513 errors when setting a restore point or running backup - Microsoft Community )
  PHP Code: sc sdset MSLLDP DD;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BG)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)(A;;CCDCLCSWRPDTLOCRSDRCWDWO;;;BA)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SO)(A;;LCRPWP;;;S-1-5-80-3141615172-2057878085-1754447212-2405740020-3916490453)(A;;CCLCSWLOCRRC;;;SU)
  
• Stop and start VSS services
• Delete old snapshots using vssadmin delete shadows /for=c: /all (there aren't any)
• Re-register VSS DLLs
• Re-install 9926

Any idea what else to try?

:)

 

can't back up or create a sys image after upgrade from w7 pro to w10 pro

After upgrading my toshiba laptap from w7 pro to w10 pro, I'm not able to create an image. It gets almost to the end and then I get "failed to create shadow copy 0x80780034. additional info the shadow copy provided an error 0x80042306". After looking at
the logs, I see two things going on.

first error was event id 12289, source VSS, "the bootfile is too small to support persistent snapshots". Some 22 seconds later, the second error is event id 513, source CAP12, "cryptographic services failed while processing the onidentity() call in the
system writer object. Details :AddlegacyDriverFiles: Unable to backup the image of binary Microsoft Link-Layer Discovery protocol. System error: Access is denied.

I've done a chkdsk and found no errors. I've checked the access control list on the registration folder and it looks right. I've also checked the vss writers and they look fine.

Any help would be great. Also, I'm not very computer savy.

 

VSS Error 12289; Backups don't work; Chkdsk doesn't work

I posted it in TechNet.

Thank you,

 

Just a shot in the dark, but have you tried DISM and SFC.EXE?

 

I can't really tell from you attachments and I don't recognize the error number, but there was a time when backups refused to work because some partition, possibly the Recovery partition did not have enough room to make shadow copies.

You might try using the WBAdmin.exe utility to try making a backup and see if it shows which partition is having problems, if one is. Otherwise look for one that is almost full. Since you probably can't see the Recovery partition as far as usage, another utility might need to be used.

I haven't tried making any Windows 10 backup images with the last few builds and I don't have it installed anywhere right now... so I can't test the situation.

 

Thanks for the feedback guys

Neither work for me on TP. I think from what I've read this is common to everyone at the moment.
PHP Code: C:\Windows\System32>dism /online /cleanup-image /checkhealth

Deployment Image Servicing and Management tool
Version: 10.0.9926.0

Image Version: 10.0.9926.0

The component store is repairable.
The operation completed successfully.

C:\Windows\System32>dism /online /cleanup-image /restorehealth

Deployment Image Servicing and Management tool
Version: 10.0.9926.0

Image Version: 10.0.9926.0

[==========================100.0%==========================]

Error: 0x800f081f

The source files could not be found.
Use the "Source" option to specify the location of the files that are required to restore the feature. For more information on specifying a source location, see Configure a Windows Repair Source.

The DISM log file can be found at C:\Windows\Logs\DISM\dism.log

C:\Windows\System32>sfc /scannow

Beginning system scan. This process will take some time.

Beginning verification phase of system scan.
Verification 3% complete.

Windows Resource Protection could not perform the requested operation.

C:\Windows\System32>

I only have one windows partition (I don't have a recovery partition) and it is only 30% full. These are my partitions - only the 4th is windows. I am booting with a legacy MBR boot with recovery files on the C:\ drive.

PHP Code: DISKPART> list volume

Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
Volume 0 D Yosemite HFS Partition 50 GB Healthy
Volume 1 C Windows10 NTFS Partition 61 GB Healthy System

DISKPART> list partition

Partition ### Type Size Offset
------------- ---------------- ------- -------
Partition 1 Primary 200 MB 512 B
Partition 2 Primary 50 GB 200 MB
Partition 3 Primary 619 MB 50 GB
Partition 4 Primary 61 GB 51 GB
PHP Code: C:\>gdisk64.exe 0:
GPT fdisk (gdisk) version 0.8.10

Partition table scan:
MBR: hybrid
BSD: not present
APM: not present
GPT: present

Found valid GPT with hybrid MBR; using GPT.

Command (? for help): r

Recovery/transformation command (? for help): o

Disk size is 236978176 sectors (113.0 GiB)
MBR disk identifier: 0x5D3CF3FA
MBR partitions:

Number Boot Start Sector End Sector Status Code
1 1 409639 primary 0xEE
2 409640 106802351 primary 0xAF
3 106802352 108071887 primary 0xAB
4 * 108072960 236976127 primary 0x07
I ran wbadmin start backup -include:c: -allCritical -backupTarget:\\Windows10\SanDisk32 and it failed with the same VSS error as in the first post unfortunately.

 

Thanks for letting me know about the DISM and SFC issues!

From this article (Event ID 12289 — Volume Shadow Copy Service Operations)
Could we have a look at the Application Event log please?

 

Here it is. Just to confirm the Volumes Shadow Copy service is set to manual (not disabled) as mentioned in your link. System protection is enabled and I've set the maximum space to 20% of my disk (which is 70% empty).

 

I tried comparing your Application log with mine - and found that mine has no VSS errors.
My VSS is set to manual, but is not started.
I have a suspicion that the VSS stuff may not be feature complete for the OS at this time (like the DISM and SFC.EXE)

Could you post a detailed description of what you did to generate the errors?
I'll do the same thing to my installation to see if it generates the same errors.

Some Windows Update and MP Telemetry errors - could be a network problem?
Lot's of "The Software Protection service has completed licensing status check" Information entries. My system has a lot of these also, so it may not be an issue.

The backup issues seem suggestive of a permissions issue. Is there anything unusual about where you're storing things, or if there's network shares involved?
I started with this google search: 0x8078006B vss - Google Search
Then I went to this link: Windows Server 2012 Windows Backup failed with following error code (Windows Backup failed to create the shared protection point on the source volumes.).
Then nere: Diagnosing Failures in Windows Server Backup - Part 1 (VSS/SPP Errors) - The Storage Team at Microsoft - File Cabinet Blog - Site Home - TechNet Blogs

And then here: http://www.sysnative.com/forums/wind...ss-issues.html (this led us to the permissions thing again). I know 2xg quite well and trust her judgement on this error. Switch to the Local System account and see if that helps.

There's a gap in the VSS entries between 3/9 at 17:12 and 3/10 at 11:32 (only 2 timeouts in between)
What was/was not going on at that time?

 

This error only happens when I trigger it. It stopped in the afternoon as I wasn't testing *Smile I can recreate it by entering either of these commands

recimg /createimage c:\customrefreshpoint (backing up to C:\ drive)
wbadmin start backup -include:c: -allCritical -backupTarget:\\Windows10\SanDisk32 (backing up to SD card defined as a share)

or making a restore point from here: (backing up to root of C:\) All give the same VSS error about finalizing the snapshot.

EDIT - I'm going to try local account and suggestions from other links now...

 

You have to fix those 2 failed writers. Here is some info:

VSS Troubleshooting Guide – Failed VSS Writers (117647)

Fix VSSAdmin WMI Writer - 'WMI Writer' Retryable Error - Spiceworks

Or re-register the VSS components

Sometimes re-registering VSS core components can fix errors. Copy the following commands to Notepad and save the file with a ‘.bat’ extension. Run the .bat file by opening a command prompt and entering the .bat file name.

cd /d %windir%\system32
net stop vss
net stop swprv
regsvr32 /s ole32.dll
regsvr32 /s oleaut32.dll
regsvr32 /s vss_ps.dll
vssvc /register
regsvr32 /s /i swprv.dll
regsvr32 /s /i eventcls.dll
regsvr32 /s es.dll
regsvr32 /s stdprov.dll
regsvr32 /s vssui.dll
regsvr32 /s msxml.dll
regsvr32 /s msxml3.dll
regsvr32 /s msxml4.dll
vssvc /register
net start swprv
net start vss

Source

And there is also this. Not sure whether that will work on your version:

Download Tweaking.com - Repair Volume Shadow Copy Service - MajorGeeks

 

Still not working - same writers are timing out and same VSS error received.. I have:

• Checked Log On user for Volumes Shadow Copy Service (it was OK)
• converted to local account
• disabled Hyper-V (just in case)
• run chkdsk
• re-registered VSS dlls again using script, the download from Macrium and and the one from major geeks. (All do the same I think).
• Configured tracing as described here (linked from @whs dell link) Troubleshooting the Volume Shadow Copy Service but the registry changes didn't result in trace.txt file being produced. Perhaps article doesn't apply to ten.

 

How about your Provider. Is that "System"

 

Yes it is. I've only got the one (see first post) and I checked registry in case of any leftovers but it was clean. (This is a fresh install).

 

I see some things in your posts I can't understand. You have a comment about using GPT with a hybrid MBR partition, but Windows 10, you mention, is installed in the legacy mode. Is the drive an Apple drive?

A Disk Management picture might help, but your configuration may not lend itself to creating a recoverable system image using the Windows utility.