Windows 10: "Shadow Copies of volume C: aborted" (Event ID 36)...

I noticed a new Error in the Windows System Event Viewer logs, one I haven't seen before. Event ID 36, Source Volsnap: "The shadow copies of volume C: were aborted because the shadow copy storage could not grow due to a user imposed limit."

I don't recall ever setting such a limit... I don't really need shadow copies. I've never made use of them, as I backup my computer to image files on an external hard drive.

That said, I'd like to be able to address the error one way or another.

What should I do? Details of event are below.

Thanks for any info!

- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
<Provider Name="Volsnap" Guid="{cb017cd2-1f37-4e65-82bc-3e91f6a37559}" EventSourceName="volsnap" />

<EventID Qualifiers="49158">36</EventID>

<Version>0</Version>

<Level>2</Level>

<Task>0</Task>

<Opcode>0</Opcode>

<Keywords>0x80000000000000</Keywords>

<TimeCreated SystemTime="2017-02-21T03:54:13.439234600Z" />

<EventRecordID>68672</EventRecordID>

<Correlation />

<Execution ProcessID="4" ThreadID="5268" />

<Channel>System</Channel>

<Computer>DESKTOP-NDLCEAK</Computer>

<Security />

</System>


- <EventData>
<Data Name="DeviceName">\Device\HarddiskVolumeShadowCopy2</Data>

<Data Name="VolumeName">C:</Data>

<Data Name="NTSTATUS">00000000</Data>

<Data Name="SourceTag">164</Data>

<Data Name="SourceFileID">0x0005</Data>

<Data Name="SourceLine">2586</Data>

<Binary>000000000600300000000000240006C0A40000000000000000000000000000000000000000000000</Binary>

</EventData>


</Event>

:)

 

Windows Update failing

Please download and run Driver View and upload a copy of the report it produces to your OneDrive. To get a report on all drivers select Edit, Select All followed by File, Save Selected Items. Text file format please, HTML files are less easy
to work with.

DriverView: Loaded Windows Drivers List

Log Name: System

Source: Volsnap

Date: 23/01/2017 19:43:46

Event ID: 36

Level: Error

Description:

The shadow copies of volume C: were aborted because the shadow copy storage
could not grow due to a user imposed limit.

 

Windows 10 Backup fails with "System cannot find the file specified 0x80070002

I had the same issue and error message.

The clue for me to resolve on my system was an Error in the event log

Event 36, volsnap

The shadow copies of volume C: were aborted because the shadow copy storage could not grow due to a user imposed limit.

After doing some research, I resolved it after performing the following steps:

1 - System Properties->System Protection Tab

2 - Enabled system protection on my C (System)

3- Configured Disk Space to a Max usage of 5% (3.73 GB). Current usage was at 1.90GB

4 - Create a restore point

5 - Chkdsk

I am now able to successfully backup my system. Hoping this saves somebody the pain of what I went through to finally resolve this.

 

Hi,


You're running out of disk space.
Right click the start button and select System then System Protection.
Either delete some old restore points or augment the disk space these can occupy.



Cheers, *Wink

 

Thanks for your reply.

I wondered about that, but C:\ shows 80.3 GB free of 154 GB... I have System Restore disabled because I don't use it. Current usage of restore points is 0 bytes. See screen clips.

Not sure what to make of this?

 

Hi,



System Protection should be set to 0 bytes.
Can you switch it back on, put the slider so it says 0 bytes and then turn it back off?
Restart the machine and check if the setting sticks.



Cheers, *Wink

 

For me, that slider is already at its lowest point. I can't set it to 0% neither with System Protection on, nor with it disabled. It goes from 1% to 100%, no zero... Is that abnormal?

Could it be that I need to increase the slider to 2% or 3% so that shadow copies are not aborted? *Confused

Thanks for your help!

 

Hi,


You're most welcome.
It's not normal, you should be able to zero it completely. Not sure what's causing it, may be an error in the registry.
Are you sure it is turned off for all drives/partitions? It looks as if there's a restore point that's still present somewhere.
I'll see if I can come up with a resolution and post it here.


Best, *Wink

 

Yes, System Protection is turned off for all drives.

Let me know what you are able to find out about this.

Thanks again *Smile

 

Hi,

Can you check if File History is turned on ?

Easiest way is through Control Panel.

Cheers, *Wink

 

File History is off. I understand that is the default. I have never turned it on; never used it.

 

Hi,
Really odd. The error is pretty much self-explanatory but should not occur in your case since System Protection is set to OFF.
However Windows sees it as being in the ON state.
So, I dug into the registry and here's a copy of what mine looks like:
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\volsnap]
"DisplayName"="@%SystemRoot%\\system32\\drivers\\volsnap.sys,-100"
"ErrorControl"=dword:00000003
"ImagePath"=hex(2):53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,64,00,\
72,00,69,00,76,00,65,00,72,00,73,00,5c,00,76,00,6f,00,6c,00,73,00,6e,00,61,\
00,70,00,2e,00,73,00,79,00,73,00,00,00
"Start"=dword:00000000
"Type"=dword:00000001
"Description"="@%SystemRoot%\\system32\\drivers\\volsnap.sys,-101"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\volsnap\Enum]
"0"="STORAGE\\Volume\\{da9ceb32-c6c4-11e6-8b2f-806e6f6e6963}#0000000000100000"
"Count"=dword:00000006
"NextInstance"=dword:00000006
"1"="STORAGE\\Volume\\{da9ceb32-c6c4-11e6-8b2f-806e6f6e6963}#000000001C300000"
"2"="STORAGE\\Volume\\{da9ceb32-c6c4-11e6-8b2f-806e6f6e6963}#0000000022700000"
"3"="STORAGE\\Volume\\{da9ceb32-c6c4-11e6-8b2f-806e6f6e6963}#0000000023700000"
"4"="STORAGE\\Volume\\{da9ceb32-c6c4-11e6-8b2f-806e6f6e6963}#00000008E3B00000"
"5"="STORAGE\\Volume\\{da9ceb32-c6c4-11e6-8b2f-806e6f6e6963}#00000035E3700000"
You can ignore the "Enum" subkey.
This should give you an idea of how it should look like.

If that still does not help then:

Cheers, *Wink

 

A snapshot of my settings:

 

I see you are dual booting. Do you have any drivers for other file systems?

Apple-HFS driver gave me this error. Perhaps other do also. Have a look with autoruns and disable any you aren't sure about.

 

Thanks for the replies and information.

Yes, I do have Paragon ExtFS for Windows installed. It allows read / write to the ext4 file system from within Windows. I don't use it all of the time, but it installs a ParagonMounter service, which is set to automatic startup by default. The program won't work if ParagonMounter service is set to manual.

I guess that could then be the cause for the origin of the aborted shadow copies?, as well as my abnormal System Protection settings.

If that's the case, I'm not too worried about it. I don't feel a need for the shadow copies. My original intent was to address the Event ID 36 by either removing the "user imposed limit" it referenced, or disabling the shadow copies.

At this point, is there anything more I should do? I guess I could just safely ignore any Event ID 36 errors in the Windows System Event Viewer logs.