Windows 10: File System Filter 'wcifs' EVENT ID 4

Hi all!

Has anyone actually already got rid of the warning in an 'official' way? Via an app-update or so. Today I got an update of the Store, it gave me some hope. But no, nothing changed :-(

Greetz!

 

I'm now thinking that the Get Office app may not be the only thing going on here so if that's so we might not get a fix until the next cumulative update at the earliest. Are you watching this thread as well?
System Restore fails: AppxStaging %ProgramFiles%\WindowsApp 0x80070091

 

Was afraid of that already. Amazing that MS doesn't give a public warning to its users. But Redmond is very quiet lately anyway. Something seems to be not ok there *Sad

The next question of course will be: what damage did this error do in the weeks it existed? Did it break vital system files? Will it have influence on updates? And if something is really destroyed, what can we as users do about it. Not happy at all with this situation. It shows that Windows 10 thanks to those pushed updates is not stable and safe to operate at all. Unfortunately, for my work I need certain Windows software. Otherwise I would have left the platform a long time ago already.

Didn't check the thread you mentioned. Tnx! But it is all much of the same. And - once again - MS keeps quiet. Weird.

 

Hi Win10usr. My comment about "not the only thing going on" was regarding the evidence that there is an update as well as an app that contribute to the problem and the possibility that there may be other apps involved as well. It's also possible that changes that MS is making to prep the system for the next major update are contributors as well. Some speculate that System Restore and File History may go away since there're related. That's something we'll only discover as events unfold. I'm comforted by knowing that the issue is widespread and therefore very likely to be resolved somehow. Just when is another matter.

As long as users make frequent images backups with 3rd party software, especially before making important changes, they'll be protected. Truthly, I have never relied on restore points nor MS backup. With the growing threat of ransomware this is should be SOP.
Bob

 

The thing is, this KB3213986 was installed here at 1-11-17. I do not have any working restore point from before that date. I do have some images, but that will be a huge hassle because much software got updated between that date and now. Also, I recovered an image made with Windows Backup & Restore from the 02-10 earlier. According to the theory in this thread, the problem should be already slumbering - but not visible yet - in that version. Which could mean THAT image is already corrupt. This I don't believe so much, because then that would have been noticable by now. It could also mean that imaging itself is not affected at all, only the restore points. Because - if I remember well - during making an image with Windows Backup & Restore, ALSO a restore point is created. Which might explain the Filter Manager errors.

All in all, a lot of uncertainties. Would you take the risk on a system used for daily work to try out putting back an image of January the 11th, then let Windows and other software run all the necessary updates to be just confronted with probably the same problem? Ok, I could then block or uninstall KB321986, but from what I understood this trick doesn't work with everyone also. I think we just have to wait and sit it out. The only one who has the true answer to all this is Microsoft. And they keep very, very quiet about this. Even questions at Technet regarding this problem are virtually unanswered / ignored. That's a bit worrying in my opinion.

I do agree that restore points never were the strongest point of Windows. However, especially now with those forced updates - including driver updates - some kind of easy rollback-option is more important then ever before. Yes, creating an image is an option but takes relatively a lot of time in comparison to using a quick system restore. If MS decides to drop system restore, they have to come up with some equally easy alternative. In fact, MS itself often advices to use a system restore in case of (driver) or other update-related problems!

Last but not least: using 3d party software would be an option, if they didn't generate the same Event ID 4 errors during use under Windows. Yes, with Macrium I can use the boot stick (still thanks for the tip!) but this is not something an average user would know and expect. It should be simple and straight-forward. Which it is not anymore thanks to a bug that is introduced somewhere in the last month. And probably the stage for this problem was set even earlier. Incredible that users of Windows 10 are just considered to be 'collateral damage', they are just left in the dark. Windows as a service is the biggest disaster that could happen to this OS. *Sad

Greetz!

 

Win10user, I agree with everything you say. That said, running a differential backup at the end of each working day with Macrium (free or paid) is relatively easy and quick. I run a full backup using a USB Macrium Rescue stick about every 2 or 3 weeks and then daily differential backups using Macrium within Windows. I think that strategy balances reliability and convenience. FYI, I've restored systems on all 4 of my PCs using both Macrium and Acronis over many years and never had a failure yet. To me this shows that are both robust and reliable. 3rd party backup software is just the price of doing business on any system especially Win10. I hope this gives you a bit of reassurance. BTW, you do store your backup on a remote drive, right?

 

Absolutely true. Until now I used the Windows tool for pure practical reasons, it became Macrium now. Despite that I think that an OS should have such capabilities onboard. Look at Apple's Time Machine (or whatever it's called) etc. And yes, I store images always on an external drive or NAS. *Tongue This worked all fine until after February 10, my last working 'regular' image. So now I have to trust Macrium. I will not even do incremental images with it I think. I have only between 50 and 60 GB on my main work system. On other computers here that's a different story *Smile


Greetz!

 

I don't like incremental backups either. If one has a problem then everything back to the last full image is useless. Oh, BTW, you do verify each image as part of the process, right?

 

This MS VSS fiasco is a serious problem with widespread repercussions.

For anyone using Acronis for backup/restore, there is a way to use native Acronis VSS capability for backup consistency instead of MS VSS.

Here are instructions: 2017 acronis vss | Acronis Forum
I have tried this; it works and no EventId 4's are logged in the Event Viewer during Acronis backups.

Of course, it would be better if Microsoft came up with a real fix for MS VSS, but until then...

 

Hi!

Sorry for the late reply... Good you reminded me, with Windows' own tool verification wasn't possible. Also not so necessary, because I ran weekly image jobs. Anyway, at the moment making an image from the Macrium boit stick WITH veryfication. Also I noticed that when making an image via the rescue stick, incremental imaging is not available. Which is good *Wink

 

Dear fellow victims,

Just installed the updates rolled out for Patch Tuesday this month. The VSS/FilterManger-problem is NOT resolved after updating. Please check and confirm. Ridiculous that MS keeps completely silent about this ugly bug. Guess we will have to do without reliable backup facilities in Windows 10 for a long time to come. It makes me very angry.


Greetz!

 

Yea, it is ... I just did a clean install of Win 10 Pro x64 with the latest updates. My fix in this thread does get rid of the error.