No announcement yet.

System State Backup failing on Windows 2003 Server R2

  • Filter
  • Time
  • Show
Clear All
new posts

  • System State Backup failing on Windows 2003 Server R2


    System State Backup failing on Windows 2003 Server R2

    I have posted this on Microsoft's server forum and have received some help. The guy who was helping me has suggested that as the steps taken are standard procedure for fixing this issue there are no further recommendations available and it was suggested that rebuilding the system may be the only solution.

    Before I try that I would like to know if anyone else has any further suggestions I can try to fix this problem.


    Here is everything I've tried:


    Windows Server 2003 R2 Standard Edition 32bit, used as a domain controller. The DC is kept up to date via WSUS. When trying to do a System State backup using NTBackup the backup job fails and the following is reported:

    Backup Status
    Operation: Backup
    Active backup destination: File
    Media name: "TitanSystemState.bkf created 09/09/2011 at 09:12"

    Volume shadow copy creation: Attempt 1.
    Timeout before function completed

    Error returned while creating the volume shadow copy:0xffffffff.

    Error returned while creating the volume shadow copy:ffffffff
    Aborting Backup.


    The operation did not successfully complete.


    The application event log contains numerous entries:

    Event Type: Error
    Event Source: NTBackup
    Event ID: 8019
    End Operation: Warnings or errors were encountered.
    Consult the backup report for more details.

    Event Type: Error
    Event Source: VSS
    Event ID: 8193
    Volume Shadow Copy Service error: Unexpected error calling routine CoCreateInstance. hr = 0x80040154.

    Event Type: Error
    Event Source: VSS
    Event ID: 20
    Volume Shadow Copy Service error: A critical component required by the Volume Shadow Copy service is not registered. This might happened if an error occurred during Windows setup or during installation of a Shadow Copy provider. The error returned from CoCreateInstance on class with CLSID {faf53cc4-bd73-4e36-83f1-2b23f46e513e} and Name VSSEvent is [0x80040154].

    Event Type: Error
    Event Source: EventSystem
    Event Category: (50)
    Event ID: 4610
    The COM+ Event System detected a bad return code during its internal processing. HRESULT was 80040154 from line 44 of d:\nt\com\complus\src\events\tier1\eventsystemobj. cpp. This may indicate that the COM+ Event System is not properly installed. Please try reinstalling the COM+ Event System.

    Event Type: Error
    Event Source: VSS
    Event ID: 12289
    Volume Shadow Copy Service error: Unexpected error CVssWriter::Subscribe for{542da469-d3e1-473c-9f4f-7847f01fc64f} COM+ REGDB Writer). hr = 0x8000ffff.

    Event Type: Error
    Event Source: VSS
    Event ID: 17
    Volume Shadow Copy Service error: The EventSystem service is disabled or is attempting to start during Safe Mode. The Volume Shadow Copy service cannot start while in safe mode. If not in safe mode, make sure that EventSystem service is enabled. CLSID:{4e14fba2-2e22-11d1-9964-00c04fbbb345} Name:CEventSystem [0x80040206]

    The attached screenshot shows the events

    NTBackup is used to backup other data from another computer and those backups succeed as shown at the bottom of the screenshot. The System State backups are scheduled for 6am and 6pm and fail. The task is configured to backup the system state and write the .bkf to another server from where it is backed up to tape. Manually running the scheduled task, and manually starting NTBackup and running a system state backup also fail.

    I have run SFC /Scannow to check the system files. The backup failed again, though. I have also used the commands described here:

    All the commands succeeded except for:

    regsvr32 /i eventcls.dll

    which returned the following:

    regsvr32 /i eventcls.dll failed. Return code was: 0x8000ffff

    The commands were being run in a command window while logged as the domain administrator.

    I have tried expanding eventcls.dl_ from the installation CD-ROM's i386 folder. However, the installed version is later than that on the CD-ROM:

    Installed = 5.2.3790.4143

    CD-ROM = 5.2.3790.1830

    The 940349 VSS update was installed some time ago. I tried re-installing this so that a new copy of eventcls.dll was installed and although installation was successful the problem persists.

    The system state backup has been working for several years and only recently failed.

    VSSadmin list writers command:

    Microsoft Windows [Version 5.2.3790]
    (C) Copyright 1985-2003 Microsoft Corp.

    C:\Documents and Settings\administrator.HTLINCS>vssadmin list writers
    vssadmin 1.1 - Volume Shadow Copy Service administrative command-line tool
    (C) Copyright 2001 Microsoft Corp.

    C:\Documents and Settings\administrator.HTLINCS>

    The problem began on Sep 6 2011 on the same day (and I hate to say it), that the system was updated via WSUS. Shadow Copies on the hard drive has never been enabled.
    Attached Files
    A recent poll suggests that 6 out of 7 dwarfs are not happy