A customer a domain member running running Server 2008, SP1 and SQL Server 2008. running 64-bit, with 3 GB. This is a virtual machine on a core installation.Beginning about 5:40 a.m. today VSS Event ID 32 is created followed immediately by VSS Event ID 8193. This has occurred about every 4 hours since.Text of Event ID 32 is:Volume Shadow Copy Service error: The VSS Coordinator class is not registered. This may be caused due to a setup failure or as a result of an application's installer or uninstaller. Operation: Instantiating VSS serverText of Event ID 8193 is:Volume Shadow Copy Service error: Unexpected error calling routine CoCreateInstance. hr = 0x80040154. Operation: Instantiating VSS serverThere does not appear to be a correlation with other events or scheduled tasks, especially not with the server backup.I found a thread indicating that this error may be caused by using 32-bit VSS applications on 64-bit OS. To the best of my knowledge this is not the case, but how can I check for this. Second question. What else may be causing this.Mike S.

Backing up the system state using NTBackup or Veritas Backup Exec may fail if you are having issues with the dll registrations for the Volume Shadow Copy service. Running the vssadmin utility and using the list writers parameters returns nothing. The syntax "vssadmin list writers". Usually this issue can be resolved by registering the dlls that are needed by the VSS service. 1.From command prompt: Cd windows\system32 Net stop vss Net stop swprv regsvr32 ole32.dll regsvr32 vss_ps.dll Vssvc /Register regsvr32 /i swprv.dll regsvr32 /i eventcls.dll regsvr32 es.dll regsvr32 stdprov.dll regsvr32 vssui.dll regsvr32 msxml.dll regsvr32 msxml3.dll regsvr32 msxml4.dll 2.After completing the registration of the DLLs open an command prompt and type: vssadmin list writers 3.You should see the writers listed. 4.Open Ntbackup and attempt to backup file or systemstate.Certifications: MCSA 2003 MCSE 2003

Thanks for replying but this has nothing to do with NTBackup or Backup Exec. The writers are listed when using the command "vssadmin list writers."Mike S.Mike S.

Thanks for replying but this has nothing to do with NTBackup or Backup Exec. The writers are listed when using the command "vssadmin list writers."Mike S. Mike S. None the less, they do recommend those commands for restoring vss function. See:http://support.microsoft.com/kb/940032.It didn't work for me either.What did work was deleting the key[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ContentIndex\Catalogs].See: http://support.microsoft.com/kb/907574.

Hi Mike, To analyze the issue, we'll need to collect some information when the event ID 32 and 8193 occurs, please run the command in the elevated mode on the problematic server. 1. vssadmin list providers > C:\provider.txt Is there any third party provider? 2. vssadmin list writers > C:\writers.txt Is there any error message with any writers? Please send the provider.txt and writer.txt to us via tfwst@microsoft.com , we can help you on analyzing it. Meanwhile, please check if there is any 32-bit VSS application installed on it. As VSS support for WOW64 was removed in Windows Vista and Windows Server 2008. If you are running a 32-bit application on 64-bit Windows Server 2008 OS, this might result in the events. Please refer the following link for more details http://msdn.microsoft.com/en-us/library/bb968832(VS.85).aspx Hope it helps. We look forward to your reply.This posting is provided "AS IS" with no warranties, and confers no rights.

David,Thanks for your help. I have sent the files to you. There appear to be no third party providers and no error messages.The link does not indicate how to tell if there are any 32-bit VSS applications installed. How is this done?Mike S.Mike S.

Hi Mike, Thank you for your log. Based on the research of the logs, we found there is no other third party provides in the system. So, it is hard to say if there is any 32-bit application installed. Generally speaking, Event ID 8193 and 32 indicates that there is something cause register wrong dll files with VSS writers that were registered on the system. The event errors should be fixed by register right dll files. Do you have a chance tofollow shadowman123's suggestion to register the corresponding 32-bit dlls that are needed by the VSS services? From command prompt switch to C:\windows\system32 to register the dll files.CD windows\system32 Net stop vssNet stop swprvregsvr32 ole32.dllregsvr32 vss_ps.dllVssvc /Registerregsvr32 /i swprv.dllregsvr32 /i eventcls.dllregsvr32 es.dllregsvr32 stdprov.dllregsvr32 vssui.dllregsvr32 msxml.dllregsvr32 msxml3.dllregsvr32 msxml4.dllPlease monitor the system for some while to see if the event error can be fixed Hope it helps. This posting is provided "AS IS" with no warranties, and confers no rights.

David,I ran the commands and received errors with eventcls.dll - the call to DllInstall failed with error code -x8000ffff; es.dll - the entry-point DllRegisterServer was not found; msxml.dll - specified module could not be found, msxml4.dll - specified module could not be found.Thanks,Mike S.Mike S.

Are you running the commands from an elevated command prompt? If not please try it again, the commands we gave you earlier. If so try to scan your dll's with sfc /scannow also from an elevated command prompt. Certifications: MCSA 2003 MCSE 2003

Hi Mike, Some of the dll files may be not successfully registered on Windows Server 2008. regsvr32 /i eventcls.dll regsvr32 msxml.dll The import dll file to VSS writer is swpr.dll, we need to verify swprv.dll can be successfully registered. If this can be done, please just monitor to see if the error can be fixed. regsvr32 /i swprv.dll Thanks.This posting is provided "AS IS" with no warranties, and confers no rights.

David,I was able to successfully register swprv.dll. I'll monitor and let you know if that fixes the problem.Mike S.Mike S.

Hi Mike,OK.If the issuewill re-occure, please feel free tolet me know.Thanks.This posting is provided "AS IS" with no warranties, and confers no rights.

David,Apparently my update yesterday did not post. The errors are still occurring.Mike S.Mike S.

Hi Mike, Please save the Application Log under Windows Logs as .evtx file and send to us for analysis. Thanks again.This posting is provided "AS IS" with no warranties, and confers no rights.

Hi David,I've sent you the log.Mike S.Mike S.

Hi Mike,I performed research on the event logs that you sent, I found Event ID 8224 (The VSS service is shutting down due to idle timeout.) follows the Event ID 8193 and 32 when the error occurs. I suspect there could be something cause the VSS error. can you try booting the problematic system with clean boot to check if the issue still exists? Steps to clean boot: 1. Click Start->Run...-> type msconfig and press Enter 2. Click Services tab and select Hide All Microsoft Services and Disable All third party Services. 3. Click Startup tab and Disable All startup items 4. Click OK and choose Restart Hope this can be helpful.This posting is provided "AS IS" with no warranties, and confers no rights.

Hi David,We actually did a clean boot this morning. The error is still occurring. Is there a way for us to increase the logging level for VSS?Mike S.Mike S.

HiPlease trobleshoot following KB &hotfix stept to resolve the VSS error for windows server 2008For 2003 Servers For 2008 940349, 949391, 951568, 957778, 968502, 967551 & 969219 959476, 959962, , 967560__________________________________________________________________________________________________________________ Windows 2008 Hotfix and DLL 1.You would not be able to hard rebuild com+ 2.The latest patch for win 2k8arehttp://support.microsoft.com/kb/959476http://support.microsoft.com/kb/959962 (required in case any connectionswith hyper-v)http://support.microsoft.com/kb/959978 net stop "System Event Notification Service"net stop "Background Intelligent Transfer Service"net stop "COM+ Event System"net stop "Microsoft Software Shadow Copy Provider "net stop "Volume Shadow Copy"cd /d %windir%\system32net stop Vssnet stop swprvregsvr32 /s ATL.DLLregsvr32 /s comsvcs.DLLregsvr32 /s credui.DLLregsvr32 /s CRYPTNET.DLLregsvr32 /s CRYPTUI.DLLregsvr32 /s dhcpqec.DLLregsvr32 /s dssenh.DLLregsvr32 /s eapqec.DLLregsvr32 /s esscli.DLLregsvr32 /s FastProx.DLLregsvr32 /s FirewallAPI.DLLregsvr32 /s kmsvc.DLLregsvr32 /s lsmproxy.DLLregsvr32 /s MSCTF.DLLregsvr32 /s msi.DLLregsvr32 /s msxml3.DLLregsvr32 /s ncprov.DLLregsvr32 /s ole32.DLLregsvr32 /s OLEACC.DLLregsvr32 /s OLEAUT32.DLLregsvr32 /s PROPSYS.DLLregsvr32 /s QAgent.DLLregsvr32 /s qagentrt.DLLregsvr32 /s QUtil.DLLregsvr32 /s raschap.DLLregsvr32 /s RASQEC.DLLregsvr32 /s rastls.DLLregsvr32 /s repdrvfs.DLLregsvr32 /s RPCRT4.DLLregsvr32 /s rsaenh.DLLregsvr32 /s SHELL32.DLLregsvr32 /s shsvcs.DLLregsvr32 /s /i swprv.DLLregsvr32 /s tschannel.DLLregsvr32 /s USERENV.DLLregsvr32 /s Vss_ps.DLLregsvr32 /s wbemcons.DLLregsvr32 /s wbemcore.DLLregsvr32 /s wbemess.DLLregsvr32 /s wbemsvc.DLLregsvr32 /s WINHTTP.DLLregsvr32 /s WINTRUST.DLLregsvr32 /s wmiprvsd.DLLregsvr32 /s wmisvc.DLLregsvr32 /s wmiutils.DLLregsvr32 /s wuaueng.DLLCd /d %systemroot%\syswow64regsvr32 /s ole32.dllregsvr32 /s Vss_ps.dllregsvr32 /s es.dllregsvr32 /s stdprov.dllregsvr32 /s msxml3.dllregsvr32 /s msxml.dllregsvr32 /s msxml4.dllnet start "COM+ Event System"sfc /SCANFILE=%windir%\system32\catsrv.DLLsfc /SCANFILE=%windir%\system32\catsrvut.DLLsfc /SCANFILE=%windir%\system32\CLBCatQ.DLLnet start "COM+ Event System"Hope this helpfulThanks... Deva --Self-trust is the first secret of success.

Hi David,We actually did a clean boot this morning. The error is still occurring. Is there a way for us to increase the logging level for VSS?Mike S. Mike S. Hi Mike,You may refer to the method in the KB http://support.microsoft.com/kb/887013 to enable the Volume Shadow Copy service's debug tracing features.Also, you can copy the commands below into notepad, and save the file as “vsstracing.bat”. Run the same to make the registry changes required to configure VSS tracing. net stop swprv reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS\Debug\Tracing /v TraceFile /t REG_SZ /d C:\trace.txt /f reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS\Debug\Tracing /v TraceLevel /t REG_DWORD /d 0xffffffff /f reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS\Debug\Tracing /v TraceEnterExit /t REG_DWORD /d 1 /f reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS\Debug\Tracing /v TraceToFile /t REG_DWORD /d 1 /f reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS\Debug\Tracing /v TraceToDebugger /t REG_DWORD /d 1 /f reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS\Debug\Tracing /v TraceFileLineInfo /t REG_DWORD /d 1 /f reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS\Debug\Tracing /v TraceForceFlush /t REG_DWORD /d 0 /fAfter running the batch file that enables tracing, we need to reproduce the issue. Once you have received the errors, stop the VSS services. You can do this by running the following commands on the command prompt. net stop VSS net stop SWPRV Then, disable VSS tracing by running the following command: reg delete HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS\Debug\Tracing /f The trace file is created on the root of the C drive.Hope it will be helpful.This posting is provided "AS IS" with no warranties, and confers no rights.

Hi David,I've sent the file. I had to let it run over night in order to capture both errors. Event ID 32 occurs every 15 minutes, Event ID 8193 occurs every 4 hours.Mike S.Mike S.

David,The email to address EMAIL GONE was rejected. Size is 6 MB. Is there a better address to send this to?Thanks,Mike S.Mike S.

Hi Mike,Please use Windows Live SkyDrive (http://www.skydrive.live.com/) to upload the file and then give us the download address.This posting is provided "AS IS" with no warranties, and confers no rights.

David,It should be at http://cid-7bc5fc70a49c044c.skydrive.live.com/browse.aspx/VSS%20Event%20ID%208193%20%5E0%2032?nl=1&uc=1&isFromRichUpload=1Mike S.Mike S.

David,I just noticed that we have another customer experiencing the same errors. This also is a virtual SQL 2008 on Server 2008 running on Server 2008 core. From the logs it appears that the errors have been occuring over a period of several months.Mike Mike S.

Hi Mike, As you may notice that the same error happens with a SQL server computer, from a detailed trace file, I found there are several security modules which maybe imported from SQL server. This might be something to do with the VSS error. We need to analysis and debug the VSS trace with source code. However, debugging is beyond what we can do in the forum. A suggestion would be to contact Microsoft Customer Service and Support (CSS) via telephone so that a dedicated Support Professional can assist with you on this case. You may obtain the phone numbers for specific technology request please take a look at the web site listed below: http://support.microsoft.com/default.aspx?scid=fh;EN-US;PHONENUMBERS If you are outside the US please see http://support.microsoft.com for regional support phone numbers. I hope the issue will be resolved soon. Thanks!This posting is provided "AS IS" with no warranties, and confers no rights.

...I've been working on this same issue. Did you ever find any resolution?

Groovescribe,I got busy and had to move on to something else for a while. I'll take a look to see if the issue is still occurring. I expect to do that next week. Please post a reminder if I don't.Thanks,Mike S.Mike S.

Groovescribe,I got busy and had to move on to something else for a while. I'll take a look to see if the issue is still occurring. I expect to do that next week. Please post a reminder if I don't.Thanks,Mike S. Mike S. I have this same issue, did you check to see if yours is resolved?

...if you have a chance, did you find any resolution to this issue. Can't seem to get an answer out of Symantec which is the direction my research took me.If you have time, I'd be interested to hear what you found. If not, no worries.Thanks Mike! Appreciate the insight!Groove

Unfortunatley I haven't been able to devote much time to this since it doesn't seem to be causing problems on the system. The frequency of both events has decreased. Event ID 32 is now occuring about every 8 hours and Event ID 8193 hasn't occured for over a week. I can't correlate any scheduled operations with the error. For example I'm backing the SQL database on the hour every hour, but when Event 32 occurs it is at 43 minutes after the hour. I am not using Volume Shadow Copies on this server.mike S.Mike S.

I received a response from Microsoft last night about a diferent VSS issue. They are telling me that SP2 for Server 2008 includes a number of hotfixes for VSS.Mike S.Mike S.

Dear David, I have same problem on windows server 2003 x64,SP2. When we initiate a systemstate backup it is happening fine. But when we initiate backup from netbackup tool it is failing. VSS service is not starting after initiating backup from tool. msxml.dll is in sysWoW64. KB940349,KB969219 already installed on server and registration of dlls went successfully. Below events are logged on server. Event ID 11: Event Type: Error Event Source: VSS Event Category: None Event ID: 11 Date: 11/22/2010 Time: 11:12:48 PM User: N/A Computer: ...... Description: Volume Shadow Copy Service information: The COM Server with CLSID {e579ab5f-1cc4-44b4-bed9-de0991ff0623} and name Coordinator cannot be started. [0x80070422] Event ID 8193: Event Type: Error Event Source: VSS Event Category: None Event ID: 8193 Date: 11/22/2010 Time: 11:12:48 PM User: N/A Computer: ............... Description: Volume Shadow Copy Service error: Unexpected error calling routine CoCreateInstance. hr = 0x80070422. Any help appreciated.