Windows 10: While creating a backup, I get this Event Viewer error.

Discus and support While creating a backup, I get this Event Viewer error. in Windows 10 Backup and Restore to solve the problem; Filter Manager failed to attach to volume '\Device\HarddiskVolume17'. This volume will be unavailable for filtering until a reboot. The final status... Discussion in 'Windows 10 Backup and Restore' started by EyeInTheSky, Dec 5, 2017.

  1. While creating a backup, I get this Event Viewer error.


    Filter Manager failed to attach to volume '\Device\HarddiskVolume17'. This volume will be unavailable for filtering until a reboot. The final status was 0xC03A001C.

    I have read several reasons why this error is thrown out during a backup, but I haven't found a solution yet. I have tried disabling the Windows Search Service as suggested by another site, but it did not solve the error being generated; so I set it back to its previous state.

    This is the error parameters:

    Log Name: System
    Source: Microsoft-Windows-FilterManager
    Date: 12/6/2017 8:15:47 AM
    Event ID: 3
    Task Category: None
    Level: Error
    Keywords:
    User: SYSTEM
    Computer: DESKTOP-9AETCF4
    Description:
    Filter Manager failed to attach to volume '\Device\HarddiskVolume17'. This volume will be unavailable for filtering until a reboot. The final status was 0xC03A001C.
    Event Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
    <System>
    <Provider Name="Microsoft-Windows-FilterManager" Guid="{F3C5E28E-63F6-49C7-A204-E48A1BC4B09D}" />
    <EventID>3</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2017-12-06T13:15:47.735281300Z" />
    <EventRecordID>19040</EventRecordID>
    <Correlation />
    <Execution ProcessID="4" ThreadID="332" />
    <Channel>System</Channel>
    <Computer>DESKTOP-9AETCF4</Computer>
    <Security UserID="S-1-5-18" />
    </System>
    <EventData>
    <Data Name="FinalStatus">0xc03a001c</Data>
    <Data Name="ExtraStringLength">24</Data>
    <Data Name="ExtraString">\Device\HarddiskVolume17</Data>
    </EventData>
    </Event>


    Any ideas or suggestions are greatly appreciated.

    :)
     
    EyeInTheSky, Dec 5, 2017
    #1
  2. JayKatai Win User

    Image Backup - Does Event ID 513 CAPI2 Affect Integrity of Backup?

    Hello,

    When I backup Windows using Image Backup I get Error 513 in the event viewer. The backup says it was successful but does this error affect the integrity of the backup? Is it okay to ignore this error?

    This is on a clean install of Windows 10 x64 Home.

    "Cryptographic Services failed while processing the OnIdentify() call in the System Writer Object.

    AddLegacyDriverFiles: Unable to back up image of binary Microsoft Link-Layer Discovery Protocol.

    Access is denied."
     
    JayKatai, Dec 5, 2017
    #2
  3. BobMunoz Win User
    "External Drive not used for a long time"

    There are (were) a few error messages in the event viewer but not when I go to Win7BU, there is nothing on the screen except a "backup and restore your files" statement and nothing else. It is not a link to anything.
     
    BobMunoz, Dec 5, 2017
    #3
  4. While creating a backup, I get this Event Viewer error.

    I would run a CHKDSK on that volume to insure it has no errors.
     
    storageman, Dec 5, 2017
    #4
  5. I scanned both volumes, meaning both my computer's SSD and external HDD backup volume and both came back with clean results:

    Log Name: Application
    Source: Chkdsk
    Date: 12/6/2017 9:21:46 PM
    Event ID: 26226
    Task Category: None
    Level: Information
    Keywords: Classic
    User: N/A
    Computer: DESKTOP-9AETCF4
    Description:
    Chkdsk was executed in scan mode on a volume snapshot.

    Checking file system on C:
    Volume label is HP.

    Stage 1: Examining basic file system structure ...

    349440 file records processed.

    File verification completed.

    4888 large file records processed.


    0 bad file records processed.


    Stage 2: Examining file name linkage ...

    461 reparse records processed.


    423316 index entries processed.

    Index verification completed.





    461 reparse records processed.


    Stage 3: Examining security descriptors ...
    Security descriptor verification completed.

    36939 data files processed.

    CHKDSK is verifying Usn Journal...

    34501992 USN bytes processed.

    Usn Journal verification completed.

    Windows has scanned the file system and found no problems.
    No further action is required.

    475297863 KB total disk space.
    33225208 KB in 135444 files.
    107168 KB in 36940 indexes.
    475315 KB in use by the system.
    65536 KB occupied by the log file.
    441490172 KB available on disk.

    4096 bytes in each allocation unit.
    118824465 total allocation units on disk.
    110372543 allocation units available on disk.

    ----------------------------------------------------------------------


    Stage 1: Examining basic file system structure ...

    Stage 2: Examining file name linkage ...

    Stage 3: Examining security descriptors ...

    Event Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
    <System>
    <Provider Name="Chkdsk" />
    <EventID Qualifiers="0">26226</EventID>
    <Level>4</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2017-12-07T02:21:46.894738200Z" />
    <EventRecordID>16718</EventRecordID>
    <Channel>Application</Channel>
    <Computer>DESKTOP-9AETCF4</Computer>
    <Security />
    </System>
    <EventData>
    <Data>

    Checking file system on C:
    Volume label is HP.

    Stage 1: Examining basic file system structure ...

    349440 file records processed.

    File verification completed.

    4888 large file records processed.


    0 bad file records processed.


    Stage 2: Examining file name linkage ...

    461 reparse records processed.


    423316 index entries processed.

    Index verification completed.





    461 reparse records processed.


    Stage 3: Examining security descriptors ...
    Security descriptor verification completed.

    36939 data files processed.

    CHKDSK is verifying Usn Journal...

    34501992 USN bytes processed.

    Usn Journal verification completed.

    Windows has scanned the file system and found no problems.
    No further action is required.

    475297863 KB total disk space.
    33225208 KB in 135444 files.
    107168 KB in 36940 indexes.
    475315 KB in use by the system.
    65536 KB occupied by the log file.
    441490172 KB available on disk.

    4096 bytes in each allocation unit.
    118824465 total allocation units on disk.
    110372543 allocation units available on disk.

    ----------------------------------------------------------------------


    Stage 1: Examining basic file system structure ...

    Stage 2: Examining file name linkage ...

    Stage 3: Examining security descriptors ...
    </Data>
    <Binary>005505003EA10200A13C050000000000820100004B0000000000000000000000</Binary>
    </EventData>
    </Event>





    And here is the external HD results:

    Log Name: Application
    Source: Chkdsk
    Date: 12/6/2017 9:25:57 PM
    Event ID: 26226
    Task Category: None
    Level: Information
    Keywords: Classic
    User: N/A
    Computer: DESKTOP-9AETCF4
    Description:
    Chkdsk was executed in scan mode on a volume snapshot.

    Checking file system on E:
    Volume label is My Passport.

    Stage 1: Examining basic file system structure ...

    1792 file records processed.

    File verification completed.

    0 large file records processed.


    0 bad file records processed.


    Stage 2: Examining file name linkage ...

    7 reparse records processed.


    1894 index entries processed.

    Index verification completed.





    7 reparse records processed.


    Stage 3: Examining security descriptors ...
    Security descriptor verification completed.

    51 data files processed.


    Windows has scanned the file system and found no problems.
    No further action is required.

    976727039 KB total disk space.
    241036584 KB in 161 files.
    180 KB in 53 indexes.
    97555 KB in use by the system.
    65536 KB occupied by the log file.
    735592720 KB available on disk.

    4096 bytes in each allocation unit.
    244181759 total allocation units on disk.
    183898180 allocation units available on disk.

    ----------------------------------------------------------------------


    Stage 1: Examining basic file system structure ...

    Stage 2: Examining file name linkage ...

    Stage 3: Examining security descriptors ...

    Event Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
    <System>
    <Provider Name="Chkdsk" />
    <EventID Qualifiers="0">26226</EventID>
    <Level>4</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2017-12-07T02:25:57.020503800Z" />
    <EventRecordID>16720</EventRecordID>
    <Channel>Application</Channel>
    <Computer>DESKTOP-9AETCF4</Computer>
    <Security />
    </System>
    <EventData>
    <Data>

    Checking file system on E:
    Volume label is My Passport.

    Stage 1: Examining basic file system structure ...

    1792 file records processed.

    File verification completed.

    0 large file records processed.


    0 bad file records processed.


    Stage 2: Examining file name linkage ...

    7 reparse records processed.


    1894 index entries processed.

    Index verification completed.





    7 reparse records processed.


    Stage 3: Examining security descriptors ...
    Security descriptor verification completed.

    51 data files processed.


    Windows has scanned the file system and found no problems.
    No further action is required.

    976727039 KB total disk space.
    241036584 KB in 161 files.
    180 KB in 53 indexes.
    97555 KB in use by the system.
    65536 KB occupied by the log file.
    735592720 KB available on disk.

    4096 bytes in each allocation unit.
    244181759 total allocation units on disk.
    183898180 allocation units available on disk.

    ----------------------------------------------------------------------


    Stage 1: Examining basic file system structure ...

    Stage 2: Examining file name linkage ...

    Stage 3: Examining security descriptors ...
    </Data>
    <Binary>00070000E10000007F0100000000000007000000000000000000000000000000</Binary>
    </EventData>
    </Event>


    I'm in need of further possibilities to resolve this issue. Since the first event log error points to a SYSTEM generated error, I'm wondering if a simple adjustment of permissions would solve this. When I look at the properties of the first error, I don't see my username listed as a possibility to take ownership of the flagged ID. I don't want to mess with the permissions until someone actually knows how to set them with a tutorial for this particular generated SYSTEM error.
     
    EyeInTheSky, Dec 6, 2017
    #5
  6. After reviewing the event error logs more closely, I found that the Event ID 3 (FilterManager) error was pointing towards a registry key. The key looks like this:

    {F3C5E28E-63F6-49C7-A204-E48A1BC4B09D}

    I found that particular key employing its template in three different locations in my registry. First, I made an export of each key to a folder on my desktop just in case deleting them would cause instability on my system, then I went ahead and deleted them from my registry.

    I want to point out that the three registry key entries at {F3C5E28E-63F6-49C7-A204-E48A1BC4B09D} were the FilterManagement key, AutoLogger key and something to do with an outdated system driver key. It was obvious to me that these registry entries were causing the event viewer to flag my external HDD as a virtual disk instead of a removable drive.

    So long story short, I deleted the key entries from the registry and this is what I got:


    While creating a backup, I get this Event Viewer error. [​IMG]



    While creating a backup, I get this Event Viewer error. [​IMG]



    While creating a backup, I get this Event Viewer error. [​IMG]


    The error was unable to regenerate itself, and my system is completely stable.

    As a side note, if you have this FilterManager error in your event viewer with error ID 3, see if the above registry key is listed in detail in your event error log report itself. If it is, your registry key may be a different value; but I bet it is what's triggering the event error in the event viewer. If you know how to export your registry keys and you have a system image of your current working OS, then and only then would I recommend trying to tackle this event log error.

    Every place I found this: {F3C5E28E-63F6-49C7-A204-E48A1BC4B09D} in the registry, I right clicked on it and deleted it from the left hand column in the registry; only after first exporting the key to a safe place in case I had to put it back.

    I'm marking this as solved.
     
    EyeInTheSky, Apr 5, 2018
    #6
Thema:

While creating a backup, I get this Event Viewer error.

Loading...
  1. While creating a backup, I get this Event Viewer error. - Similar Threads - While creating backup

  2. Error in Event Viewer

    in Windows 10 BSOD Crashes and Debugging
    Error in Event Viewer: ESENT Event ID 508,510 and 533 warnings in Event Viewer also poor shut down times start up and have nothing running at start up critical errors multi time daily system restore error event id 8193 vss error windows 10 i did a repair install so far so good as far as vvs goes...
  3. Event viewer : error when creating custom view

    in Windows 10 BSOD Crashes and Debugging
    Event viewer : error when creating custom view: Hi, I can't create a custom view. When I click on "Custom View" under "Event Viewer (Local)" I get an error "MMC has detected an error in a snap-in and will unload it" [ATTACH] The detailed error appears after : [ATTACH] Content is :...
  4. Windows Search / Cortana lags and create errors in event viewer

    in Windows 10 Software and Apps
    Windows Search / Cortana lags and create errors in event viewer: so like the title says whenever I use windows search / cortana it lags and create errors in event viewer from dcomp.dll , now i have ran dism and did an in place windows upgrade mind you reinstalling cortana package using power shell , clean booted yet still as is , any other...
  5. Event Viewer Errors

    in Windows 10 BSOD Crashes and Debugging
    Event Viewer Errors: Win10 pro Hi, Thanks for checking this out I have 3 errors I used Reset this PC to remove files but I use a external drive for games and some directory's like desktop, Pictures, docs, and games ect… fyi I didn't use a fresh install of windows I used Reset my PC. If anyone...
  6. Getting nvlddmkm error in event viewer, game crashing

    in Windows 10 Graphic Cards
    Getting nvlddmkm error in event viewer, game crashing: Hi, I've been getting nvlddmkm errors in event viewer every time I play the game Outlast 2 which was just released. I'm using Lenovo IdeaPad laptop, while not high specs, it can run the game at 60fps at mid-high settings with no problem so I highly doubt that it's not...
  7. Event Viewer Error

    in Windows 10 Performance & Maintenance
    Event Viewer Error: Hi All, I updated Win8.1 to Win10, so Event Viewer will suddenly appear two windows every 10 minutes*Sad*Sad. Please see the attached figure. Would someone help me solve this problem? How can I block it? Thanks. [img] 88395
  8. Event Viewer error

    in Windows 10 Performance & Maintenance
    Event Viewer error: I have 599 errors of this. I have run SFC /Scannow and Dism /Online /Cleanup-Image /RestoreHealth. It didn't find any errors. I have Googled and searched here and can not find a fix. Is this something to worry about? [img] 47494
  9. Error in Event Viewer

    in Windows 10 Support
    Error in Event Viewer: I have an entry in Event Viewer related to TCP Sharing... The NetTcpActivator service depends on the NetTcpPortSharing service which failed to start because of the following error: The service cannot be started, either because it is disabled or because it has no enabled...
  10. Access Denied while clearing Event Viewer error in Powershell

    in Windows 10 Support
    Access Denied while clearing Event Viewer error in Powershell: I am trying to cleat all the events in my event viewer as I had so many errors in the past 7 days. I opened powershell & ran as administrator & use this command wevtutil el | Foreach-Object {wevtutil cl “$_”} & I had some access denied errors. PS C:\Windows\system32>...

Users found this page by searching for:

  1. filter manager 0xc03a001c