Windows Server 2008 R2 Backup problem

I have a domain controller which holds all FSMO roles installed on W2k8 R2 SP1 machine. Last friday I set up system state backup in WSB and backup was completed successfully. But, today I set up scheduled backup of system state which failed and later I set up backup once of system state which failed too. In Windows log for WSB there is following error:

Error in deletion of [C:\System Volume Information\EfaData\SYMEFA.DB] while pruning the target VHD: Error [0x80070020] The process cannot access the file because it is being used by another process.

Any help will be very useful. Thanks in advance!!!

 

 

August 22nd, 2011 9:29am

Hi,

 

Did you receive any error when running Windows Server Backup? Please also write down the detailed error messages received in the Event Log. Please run “Vssadmin list writers” for troubleshooting. Any errors? If so, you may try restarting the Cryptographic Service and failed writers service. You can also paste the results here for research.

 

For more information on diagnosing the Volume Shadow Copy service writer problem, please refer to the following link:

 

Time-out errors occur in Volume Shadow Copy service writers, and shadow copies are lost during backup and during times when there are high levels of input/output

http://support.microsoft.com/kb/826936

 

Thanks.

Nina

Free Windows Admin Tool Kit Click here and download it now
August 26th, 2011 5:31am

No luck, I run Vssadmin list writers, there are no errors. Unlocker software reported that file is not locked out but backup is constantly failing because of locked file. Strange problem.

September 1st, 2011 7:50am

Hello

since update of Symantec endpoint protection client 12.1.X on my Domain controler W2K8R2 i have the same problem of you.
The backup systemstate abort

see the log :

Erreur de suppression de [\\?\Volume{e84a2e42-3129-11df-9e8e-806e6f6e6963}\System Volume Information\EfaData\SYMEFA.DB] lors du nettoyage du disque dur virtuel cible : erreur [0x80070020] Le processus ne peut pas accéder au fichier car ce fichier est utilisé par un autre processus.

for the moment symantec don't have any solution and my CASE is open.

  • Proposed as answer by helpordi Tuesday, September 13, 2011 10:26 AM
Free Windows Admin Tool Kit Click here and download it now
September 12th, 2011 12:46pm

Hello,

hello
I found the solution after several days of research. just reformat the target partition to which you save the systemestate.

September 13th, 2011 10:33am

I have to warn you to expect the same error within a few days because even without reformatting of target partition backup works well after deletion of WindowsImageBackup folder, for a few days only. In my case it worked well for 6 days and after that this error is occuring every day.

Free Windows Admin Tool Kit Click here and download it now
September 16th, 2011 7:00am

I had the same problem on server running the new SEP12.1. I tried to format the disk but the error occured the second day. I think this might be related to Symantec. Can someone open a case in SEP official forum? My English is not good though.

September 16th, 2011 8:12am

Symantec has a temporary workaround in the TECH168402

http://www.symantec.com/business/support/index?page=content&id=TECH168402

Free Windows Admin Tool Kit Click here and download it now
January 29th, 2012 7:05pm

It worked well for a few days, but now the same error appears.

At first, I have done this: (from Symantec forum)

Detailed steps

1. Disable Tamper Protection

2. Add the following multistring value to the following registry keys:

*HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\BackupRestore\FilesNotToBackup

*HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\BackupRestore\FilesNotToSnapshot

1. %AllVolumes%\System Volume Information\EfaData\SYMEFA.DB

2. *\symefa.db

3. C:\System Volume Information\EfaData\SYMEFA.DB\

4. \System Volume Information\EfaData\SYMEFA.DB

5. %AllVolumes%\System Volume Information\EfaData\*%AllVolumes%\System Volume Information\EfaData

3. Delete all existing backups. Note: Do not skip this step. Volume Shadow Copy will not remove a file that has been added to the backup exclusions if it already exists and can cause the behavior to continue.

4. Recreate the backups as new backups jobs.

5. Re-enable Tamper Protection 

It worked well for only short period of time. Later I followed link 

http://www.symantec.com/business/support/index?page=content&id=TECH168402

and added these registry values, but error has re-appeared today. This is like mission impossible. 







  • Edited by BoxiKG Monday, February 13, 2012 11:11 AM
February 13th, 2012 11:08am

Hello,

Please try one of the following two options:

1 - Disable SymEFA, which breaks the lock on SYMEFA.DB

or

2 - 

1. Deploy a full SEP package
2. Disable Tamper Protection through Change Settings > Client Management > Configure Settings > Tamper Protection tab > Remove check mark from "Protect...."
2. Navigate to the drivers for symefa.sys: C:\Windows\System32\drivers\SEP\0C01029F\136B.105\x64
3. Delete three files associated with symefa  (name) SymEFA.inf / SymEfa64.cat / SymEFA64.sys
4. Restart the machine
5. Navigate to the EFAdata folder ins Sys Vol Info, take ownership of the folder (be certain you are listed in the permissions view)
6. Delete the contents of the C:\System Volume Information\EfaData folder via command line


del "C:\System Volume Information\EfaData"


7. Ensure the folder is empty, and then attempt a backup with Windows Backup

Let me know if either helped.

The fix for this is targeted for SEP 12.1 RU1 MP1 which should be out in April / May.



  • Edited by Lillian75 Monday, March 12, 2012 2:11 PM
Free Windows Admin Tool Kit Click here and download it now
March 12th, 2012 12:32pm

I had this problem too. I do not know if you already solve. But I had to put the folder "WindowsImageBackup" as an exception to SEP does not perform the scan. This was my solution for two DCs.
August 3rd, 2012 12:04pm

Hi,

I have same problem, i am taking data backup, from last 1 year it was working file but from 1 month its giving problem. when i change destination its work for 5-10 days but after same problem. I tried to backup after disabled  Kaspersky and rebooted the server but its not work. We are getting below error.

Error in deletion of [E:\System Volume Information\001.dat] while pruning the target VHD: Error [0x80070020] The process cannot access the file because it is being used by another process.

Note: E Drive is source drive

Free Windows Admin Tool Kit Click here and download it now
June 13th, 2015 2:09am

This topic is archived. No further replies will be accepted.

Other recent topics Other recent topics