Introduction to Volume Shadow Copy Service on Windows Server 2019

The Volume Shadow Copy Service (VSS) is a core Windows infrastructure component that enables the creation of consistent point-in-time snapshots of volumes, even while applications are actively writing to disk. VSS coordinates with VSS requestors (backup applications), VSS providers (storage drivers or hardware), and VSS writers (application-specific components like SQL Server, Exchange, and Active Directory) to create crash-consistent or application-consistent snapshots. Understanding and correctly configuring VSS is essential for reliable backups on Windows Server 2019, as almost every enterprise backup solution — including Windows Server Backup, Veeam, and Azure Backup — relies on VSS under the hood.

VSS Architecture: Requestors, Providers, and Writers

A VSS requestor is any application that initiates a shadow copy operation. Windows Server Backup, NTBackup, and third-party backup tools all act as VSS requestors. A VSS provider is the component responsible for actually creating and maintaining the shadow copy. Windows includes a default System Provider (software-based), and hardware vendors supply hardware providers for SAN-based snapshots. VSS writers are application-specific plugins that receive VSS notifications to freeze application I/O before the snapshot is taken and thaw I/O after the snapshot completes. Built-in writers include the Registry Writer, NTDS Writer (Active Directory), SQL Server VSS Writer, and IIS Metabase Writer.

Checking VSS Writer Status

Before troubleshooting backup failures, always check VSS writer health. A failed or unstable VSS writer can cause backup jobs to fail even when the storage and backup software are functioning correctly. Use the vssadmin command-line tool to list all registered VSS writers and their current states:

vssadmin list writers

In the output, each writer shows its State and Last error. A healthy writer shows State: [1] Stable and Last error: No error. Problematic states include:

State [5] Waiting for completion — the writer is stuck, usually recoverable by restarting the relevant service. State [7] Failed — the writer encountered an error during the last VSS operation. State [8] Error — the writer is in a permanent error state and needs its associated service restarted. For example, if the SQL Server VSS Writer shows a failed state, restart the SQL VSS Writer service:

net stop SQLWriter
net start SQLWriter

For the Windows Management Instrumentation writer:

net stop winmgmt
net start winmgmt

Listing and Managing Shadow Copies

Existing shadow copies on the system can be listed using vssadmin:

vssadmin list shadows

To list shadow copies for a specific volume:

vssadmin list shadows /for=C:

To display the maximum storage allocated for shadow copies and current usage:

vssadmin list shadowstorage

By default, VSS shadow copy storage grows dynamically. You can set a maximum storage limit to prevent shadow copies from consuming too much disk space:

vssadmin resize shadowstorage /for=C: /on=C: /maxsize=15GB

Setting a maximum size causes VSS to delete the oldest shadow copies when the limit is reached. If the volume fills completely, VSS will abort the shadow copy creation.

Creating Manual Shadow Copies

You can manually create a shadow copy of any volume for testing or ad-hoc recovery purposes using vssadmin:

vssadmin create shadow /for=C:

To create a shadow copy using PowerShell and the Win32_ShadowCopy WMI class:

$class = [WMICLASS]"rootcimv2:win32_shadowcopy"
$result = $class.create("C:", "ClientAccessible")
$result.ShadowID

To mount a shadow copy as an accessible drive letter for file browsing and manual recovery:

mklink /d C:ShadowMount \?GLOBALROOTDeviceHarddiskVolumeShadowCopy1

Replace HarddiskVolumeShadowCopy1 with the device name shown in vssadmin list shadows output. After mounting, browse C:ShadowMount to access files from the point-in-time snapshot.

Enabling Previous Versions (Client-Accessible Shadow Copies)

Windows Server 2019 supports Previous Versions for shared folders, allowing end users to self-service recover accidentally deleted or overwritten files. This feature is powered by VSS. To enable it, open Server Manager, navigate to the volume properties, select the Shadow Copies tab (or use the command line):

vssadmin create shadow /for=D:

To configure a scheduled task that creates shadow copies on a regular schedule (for example, weekdays at 7 AM and noon):

schtasks /create /tn "VSS Shadow Copy D 7AM" /tr "vssadmin create shadow /for=D:" /sc weekly /d MON,TUE,WED,THU,FRI /st 07:00 /ru SYSTEM /f

schtasks /create /tn "VSS Shadow Copy D 12PM" /tr "vssadmin create shadow /for=D:" /sc weekly /d MON,TUE,WED,THU,FRI /st 12:00 /ru SYSTEM /f

Alternatively, use the built-in Shadow Copies configuration in the volume properties dialog in Windows Explorer. Right-click a volume in Computer Management > Disk Management, select Properties, then the Shadow Copies tab. Enable shadow copies and configure the schedule and storage settings from there.

Configuring VSS for Application-Consistent Backups

Application-consistent backups require that the relevant VSS writer for the application is registered, stable, and properly configured. For SQL Server on Windows Server 2019, ensure the SQL Server VSS Writer service is running and set to Automatic start:

Set-Service -Name SQLWriter -StartupType Automatic
Start-Service -Name SQLWriter

For Active Directory on domain controllers, the NTDS VSS writer handles AD-consistent backups. Verify it is registered:

vssadmin list writers | findstr -i "AD"

The output should show Active Directory Domain Services writer with State: [1] Stable. If it appears missing or failed, check the services for Active Directory Domain Services (NTDS) and restart if necessary.

VSS Provider Management

The default Windows System VSS Provider handles software-based shadow copies. For SAN or storage array environments, a hardware provider from the storage vendor may be installed for better performance and snapshot consistency. List all registered providers:

vssadmin list providers

If you suspect a hardware provider is causing backup failures, you can temporarily test with only the software provider by unregistering the hardware provider, running a test backup, and re-registering it if the problem is confirmed to be provider-related. Hardware provider registration is handled by the storage vendor’s installation package.

Troubleshooting VSS Errors

Common VSS errors and their resolutions:

Error 0x8004230F (VSS_E_UNEXPECTED_WRITER_ERROR): A VSS writer threw an unexpected exception. Check the Application event log for the specific writer name and associated error. Restart the writer’s service.

Error 0x80042301 (VSS_E_PROVIDER_VETO): The VSS provider rejected the shadow copy request. This often occurs when antivirus software intercepts VSS I/O. Exclude the VSS shadow storage area and the Vss provider process from real-time scanning.

Error 0x8004231F (VSS_E_WRITERERROR_NONRETRYABLE): A writer failed with a non-retryable error. Restart the writer’s service and retry the backup.

Get-WinEvent -LogName Application -MaxEvents 50 | Where-Object { $_.ProviderName -like "*VSS*" } | Select-Object TimeCreated, Id, Message | Format-List

The Volsnap event log also contains detailed VSS storage driver events:

Get-WinEvent -LogName System | Where-Object { $_.ProviderName -eq "volsnap" } | Select-Object TimeCreated, Id, Message | Format-List

Deleting Stale Shadow Copies

If shadow copy storage is full or you need to reclaim disk space, delete shadow copies using vssadmin. To delete the oldest shadow copy for a volume:

vssadmin delete shadows /for=C: /oldest

To delete all shadow copies for a volume (use with caution — this removes all recovery points):

vssadmin delete shadows /for=C: /all /quiet

To delete a specific shadow copy by its shadow ID:

vssadmin delete shadows /shadow={shadow-copy-id-guid}