Windows 10: While creating a backup, I get this Event Viewer error.

Filter Manager failed to attach to volume '\Device\HarddiskVolume17'. This volume will be unavailable for filtering until a reboot. The final status was 0xC03A001C.

I have read several reasons why this error is thrown out during a backup, but I haven't found a solution yet. I have tried disabling the Windows Search Service as suggested by another site, but it did not solve the error being generated; so I set it back to its previous state.

This is the error parameters:

Log Name: System
Source: Microsoft-Windows-FilterManager
Date: 12/6/2017 8:15:47 AM
Event ID: 3
Task Category: None
Level: Error
Keywords:
User: SYSTEM
Computer: DESKTOP-9AETCF4
Description:
Filter Manager failed to attach to volume '\Device\HarddiskVolume17'. This volume will be unavailable for filtering until a reboot. The final status was 0xC03A001C.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-FilterManager" Guid="{F3C5E28E-63F6-49C7-A204-E48A1BC4B09D}" />
<EventID>3</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8000000000000000</Keywords>
<TimeCreated SystemTime="2017-12-06T13:15:47.735281300Z" />
<EventRecordID>19040</EventRecordID>
<Correlation />
<Execution ProcessID="4" ThreadID="332" />
<Channel>System</Channel>
<Computer>DESKTOP-9AETCF4</Computer>
<Security UserID="S-1-5-18" />
</System>
<EventData>
<Data Name="FinalStatus">0xc03a001c</Data>
<Data Name="ExtraStringLength">24</Data>
<Data Name="ExtraString">\Device\HarddiskVolume17</Data>
</EventData>
</Event>


Any ideas or suggestions are greatly appreciated.

:)

 

Image Backup - Does Event ID 513 CAPI2 Affect Integrity of Backup?

Hello,

When I backup Windows using Image Backup I get Error 513 in the event viewer. The backup says it was successful but does this error affect the integrity of the backup? Is it okay to ignore this error?

This is on a clean install of Windows 10 x64 Home.

"Cryptographic Services failed while processing the OnIdentify() call in the System Writer Object.

AddLegacyDriverFiles: Unable to back up image of binary Microsoft Link-Layer Discovery Protocol.

Access is denied."

 

"External Drive not used for a long time"

There are (were) a few error messages in the event viewer but not when I go to Win7BU, there is nothing on the screen except a "backup and restore your files" statement and nothing else. It is not a link to anything.

 

I would run a CHKDSK on that volume to insure it has no errors.

 

I scanned both volumes, meaning both my computer's SSD and external HDD backup volume and both came back with clean results:

Log Name: Application
Source: Chkdsk
Date: 12/6/2017 9:21:46 PM
Event ID: 26226
Task Category: None
Level: Information
Keywords: Classic
User: N/A
Computer: DESKTOP-9AETCF4
Description:
Chkdsk was executed in scan mode on a volume snapshot.

Checking file system on C:
Volume label is HP.

Stage 1: Examining basic file system structure ...

349440 file records processed.

File verification completed.

4888 large file records processed.


0 bad file records processed.


Stage 2: Examining file name linkage ...

461 reparse records processed.


423316 index entries processed.

Index verification completed.





461 reparse records processed.


Stage 3: Examining security descriptors ...
Security descriptor verification completed.

36939 data files processed.

CHKDSK is verifying Usn Journal...

34501992 USN bytes processed.

Usn Journal verification completed.

Windows has scanned the file system and found no problems.
No further action is required.

475297863 KB total disk space.
33225208 KB in 135444 files.
107168 KB in 36940 indexes.
475315 KB in use by the system.
65536 KB occupied by the log file.
441490172 KB available on disk.

4096 bytes in each allocation unit.
118824465 total allocation units on disk.
110372543 allocation units available on disk.

----------------------------------------------------------------------


Stage 1: Examining basic file system structure ...

Stage 2: Examining file name linkage ...

Stage 3: Examining security descriptors ...

Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Chkdsk" />
<EventID Qualifiers="0">26226</EventID>
<Level>4</Level>
<Task>0</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2017-12-07T02:21:46.894738200Z" />
<EventRecordID>16718</EventRecordID>
<Channel>Application</Channel>
<Computer>DESKTOP-9AETCF4</Computer>
<Security />
</System>
<EventData>
<Data>

Checking file system on C:
Volume label is HP.

Stage 1: Examining basic file system structure ...

349440 file records processed.

File verification completed.

4888 large file records processed.


0 bad file records processed.


Stage 2: Examining file name linkage ...

461 reparse records processed.


423316 index entries processed.

Index verification completed.





461 reparse records processed.


Stage 3: Examining security descriptors ...
Security descriptor verification completed.

36939 data files processed.

CHKDSK is verifying Usn Journal...

34501992 USN bytes processed.

Usn Journal verification completed.

Windows has scanned the file system and found no problems.
No further action is required.

475297863 KB total disk space.
33225208 KB in 135444 files.
107168 KB in 36940 indexes.
475315 KB in use by the system.
65536 KB occupied by the log file.
441490172 KB available on disk.

4096 bytes in each allocation unit.
118824465 total allocation units on disk.
110372543 allocation units available on disk.

----------------------------------------------------------------------


Stage 1: Examining basic file system structure ...

Stage 2: Examining file name linkage ...

Stage 3: Examining security descriptors ...
</Data>
<Binary>005505003EA10200A13C050000000000820100004B0000000000000000000000</Binary>
</EventData>
</Event>





And here is the external HD results:

Log Name: Application
Source: Chkdsk
Date: 12/6/2017 9:25:57 PM
Event ID: 26226
Task Category: None
Level: Information
Keywords: Classic
User: N/A
Computer: DESKTOP-9AETCF4
Description:
Chkdsk was executed in scan mode on a volume snapshot.

Checking file system on E:
Volume label is My Passport.

Stage 1: Examining basic file system structure ...

1792 file records processed.

File verification completed.

0 large file records processed.


0 bad file records processed.


Stage 2: Examining file name linkage ...

7 reparse records processed.


1894 index entries processed.

Index verification completed.





7 reparse records processed.


Stage 3: Examining security descriptors ...
Security descriptor verification completed.

51 data files processed.


Windows has scanned the file system and found no problems.
No further action is required.

976727039 KB total disk space.
241036584 KB in 161 files.
180 KB in 53 indexes.
97555 KB in use by the system.
65536 KB occupied by the log file.
735592720 KB available on disk.

4096 bytes in each allocation unit.
244181759 total allocation units on disk.
183898180 allocation units available on disk.

----------------------------------------------------------------------


Stage 1: Examining basic file system structure ...

Stage 2: Examining file name linkage ...

Stage 3: Examining security descriptors ...

Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Chkdsk" />
<EventID Qualifiers="0">26226</EventID>
<Level>4</Level>
<Task>0</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2017-12-07T02:25:57.020503800Z" />
<EventRecordID>16720</EventRecordID>
<Channel>Application</Channel>
<Computer>DESKTOP-9AETCF4</Computer>
<Security />
</System>
<EventData>
<Data>

Checking file system on E:
Volume label is My Passport.

Stage 1: Examining basic file system structure ...

1792 file records processed.

File verification completed.

0 large file records processed.


0 bad file records processed.


Stage 2: Examining file name linkage ...

7 reparse records processed.


1894 index entries processed.

Index verification completed.





7 reparse records processed.


Stage 3: Examining security descriptors ...
Security descriptor verification completed.

51 data files processed.


Windows has scanned the file system and found no problems.
No further action is required.

976727039 KB total disk space.
241036584 KB in 161 files.
180 KB in 53 indexes.
97555 KB in use by the system.
65536 KB occupied by the log file.
735592720 KB available on disk.

4096 bytes in each allocation unit.
244181759 total allocation units on disk.
183898180 allocation units available on disk.

----------------------------------------------------------------------


Stage 1: Examining basic file system structure ...

Stage 2: Examining file name linkage ...

Stage 3: Examining security descriptors ...
</Data>
<Binary>00070000E10000007F0100000000000007000000000000000000000000000000</Binary>
</EventData>
</Event>


I'm in need of further possibilities to resolve this issue. Since the first event log error points to a SYSTEM generated error, I'm wondering if a simple adjustment of permissions would solve this. When I look at the properties of the first error, I don't see my username listed as a possibility to take ownership of the flagged ID. I don't want to mess with the permissions until someone actually knows how to set them with a tutorial for this particular generated SYSTEM error.

 

After reviewing the event error logs more closely, I found that the Event ID 3 (FilterManager) error was pointing towards a registry key. The key looks like this:

{F3C5E28E-63F6-49C7-A204-E48A1BC4B09D}

I found that particular key employing its template in three different locations in my registry. First, I made an export of each key to a folder on my desktop just in case deleting them would cause instability on my system, then I went ahead and deleted them from my registry.

I want to point out that the three registry key entries at {F3C5E28E-63F6-49C7-A204-E48A1BC4B09D} were the FilterManagement key, AutoLogger key and something to do with an outdated system driver key. It was obvious to me that these registry entries were causing the event viewer to flag my external HDD as a virtual disk instead of a removable drive.

So long story short, I deleted the key entries from the registry and this is what I got:













The error was unable to regenerate itself, and my system is completely stable.

As a side note, if you have this FilterManager error in your event viewer with error ID 3, see if the above registry key is listed in detail in your event error log report itself. If it is, your registry key may be a different value; but I bet it is what's triggering the event error in the event viewer. If you know how to export your registry keys and you have a system image of your current working OS, then and only then would I recommend trying to tackle this event log error.

Every place I found this: {F3C5E28E-63F6-49C7-A204-E48A1BC4B09D} in the registry, I right clicked on it and deleted it from the left hand column in the registry; only after first exporting the key to a safe place in case I had to put it back.

I'm marking this as solved.