How to Configure Volume Shadow Copy Service (VSS) on Windows Server 2012 R2

How to Configure Volume Shadow Copy Service (VSS) on Windows Server 2012 R2

The Volume Shadow Copy Service (VSS) is a critical component of the Windows Server 2012 R2 data protection framework. It enables the creation of point-in-time, application-consistent snapshots of volumes without interrupting running services or applications. VSS is used by Windows Server Backup, System Center Data Protection Manager, Azure Backup, and most third-party backup products to ensure that databases, Exchange mailboxes, SQL Server data files, and other application data are captured in a consistent state. This guide covers VSS architecture, configuration, management via the command line, and troubleshooting common shadow copy issues.

Understanding VSS Architecture

VSS operates through three primary components working in concert. The VSS Requestor is the application (backup software) that requests a snapshot. The VSS Provider creates and manages the snapshot — the system provider is built into Windows and creates snapshots at the block level within NTFS volumes. VSS Writers are registered by applications (SQL Server, Exchange, Active Directory, IIS) to notify VSS when it is safe to quiesce application data to disk before the snapshot is taken.

When a VSS snapshot is requested, the process follows this sequence: the requestor signals VSS; VSS notifies all registered writers to quiesce their data; once all writers confirm readiness, the provider creates the shadow copy; writers are then notified to resume normal operations. The entire freeze typically lasts only a few seconds, making the impact on production services negligible.

Prerequisites

Administrator privileges are required. The Volume Shadow Copy Service must be running (it starts automatically on Windows Server 2012 R2). For scheduled shadow copies, sufficient free space must be available on each volume — Microsoft recommends at least 10% of the volume size be available for shadow copy storage. The Shadow Copies feature is available for NTFS volumes only.

Step 1: Enable Shadow Copies on a Volume

To enable shadow copies on a volume using the GUI, right-click the drive in Windows Explorer or Disk Management, select Properties, and navigate to the Shadow Copies tab. Select the volume and click Enable. This enables shadow copies with default storage settings (the shadow copy storage is on the same volume by default, limited to 10% of volume size).

To enable shadow copies from the command line using vssadmin:

vssadmin add shadowstorage /for=D: /on=E: /maxsize=20GB

This command places shadow copy storage for the D: volume on the E: drive with a maximum size of 20 GB. Storing shadow copies on a separate volume from the source data is best practice as it protects shadow copies from volume failure and improves performance.

Step 2: Create a Shadow Copy Manually

To create an immediate shadow copy of a volume:

vssadmin create shadow /for=C:

The output provides the shadow copy ID and creation time. Record the shadow copy ID if you need to reference it later. To create shadow copies of all volumes simultaneously:

vssadmin create shadow /for=C: /autoretry=5
vssadmin create shadow /for=D: /autoretry=5

Using PowerShell with the WMI interface:

$class = [wmiclass]"rootcimv2:Win32_ShadowCopy"
$volume = "C:"
$result = $class.Create($volume, "ClientAccessible")
Write-Host "Shadow copy ID: $($result.ShadowID)"

Step 3: Schedule Automatic Shadow Copies

Shadow copies are most valuable when created on a scheduled basis. Windows Server 2012 R2 supports up to 64 shadow copies per volume; when the limit is reached, the oldest copy is automatically deleted. The default schedule (when enabled via the GUI) creates copies at 7:00 AM and 12:00 PM on weekdays.

To configure a custom schedule using Task Scheduler and vssadmin, create a scheduled task that runs vssadmin at specified times:

schtasks /create /tn "VSS Shadow Copy C Drive" /tr "vssadmin create shadow /for=C:" /sc DAILY /st 07:00 /ru SYSTEM /f
schtasks /create /tn "VSS Shadow Copy C Drive Evening" /tr "vssadmin create shadow /for=C:" /sc DAILY /st 18:00 /ru SYSTEM /f

For a PowerShell-based scheduled task with more control:

$action = New-ScheduledTaskAction -Execute "vssadmin.exe" -Argument "create shadow /for=D:"
$trigger1 = New-ScheduledTaskTrigger -Daily -At 7am
$trigger2 = New-ScheduledTaskTrigger -Daily -At 12pm
$trigger3 = New-ScheduledTaskTrigger -Daily -At 6pm
$settings = New-ScheduledTaskSettingsSet -RunOnlyIfNetworkAvailable:$false
Register-ScheduledTask -TaskName "VSS_D_Drive" -Action $action -Trigger @($trigger1, $trigger2, $trigger3) -Settings $settings -RunLevel Highest -User "SYSTEM"

Step 4: List and Query Shadow Copies

To list all shadow copies currently on the system:

vssadmin list shadows

To list shadow copies for a specific volume:

vssadmin list shadows /for=D:

To view current shadow copy storage usage:

vssadmin list shadowstorage

Using PowerShell to query all shadow copies with details:

Get-WmiObject Win32_ShadowCopy | Select-Object ID, VolumeName, InstallDate, DeviceObject | Format-Table -AutoSize

Step 5: Access and Restore from a Shadow Copy

End users can access previous versions through the Previous Versions tab in Windows Explorer (right-click a file or folder, select Properties, then Previous Versions). This provides a self-service restore mechanism that reduces helpdesk workload.

To expose a shadow copy as a mounted volume for administrative access:

# Get the shadow copy device object
vssadmin list shadows /for=D:

# Mount the shadow copy (replace with your actual shadow copy device path)
mklink /d C:ShadowMount "\?GLOBALROOTDeviceHarddiskVolumeShadowCopy5"

After mounting, you can browse the shadow copy as a regular folder and copy files. Remove the mount point when finished:

rmdir C:ShadowMount

Step 6: Check VSS Writer Status

VSS writers must be in a stable state for application-consistent backups to succeed. Check all registered writers:

vssadmin list writers

Each writer should show a State of [1] Stable and a Last error of No error. Common writers include SQLSERVERWRITER, EXCHANGE WRITER, REGISTRY WRITER, SYSTEM WRITER, and WMI WRITER. If a writer shows a failed state, restart the associated service. For example, to restart the SQL Server VSS Writer:

net stop SQLWriter
net start SQLWriter

If writers remain in an unstable state after service restarts, restart the VSS service itself (note: this briefly impacts any in-progress backup operations):

net stop vss
net start vss

Step 7: Manage Shadow Copy Storage

Monitor shadow copy storage usage to prevent unexpected deletions of older copies. Resize the shadow copy storage area:

vssadmin resize shadowstorage /for=D: /on=E: /maxsize=30GB

Delete all shadow copies for a specific volume (use with caution):

vssadmin delete shadows /for=D: /quiet

Delete a specific shadow copy by ID:

vssadmin delete shadows /shadow={SHADOW-COPY-GUID} /quiet

Step 8: Configure VSS for SQL Server

SQL Server requires the SQL Server VSS Writer service to be running for application-consistent backups. Verify and start the writer service:

Get-Service -Name "SQLWriter" | Select-Object Name, Status, StartType
Set-Service -Name "SQLWriter" -StartupType Automatic
Start-Service -Name "SQLWriter"

Verify SQL Server databases are visible to VSS:

vssadmin list writers | Select-String -Pattern "SQL" -Context 0,5

Summary

The Volume Shadow Copy Service is a foundational component of any Windows Server 2012 R2 data protection strategy. Proper VSS configuration ensures that backups capture application-consistent snapshots rather than crash-consistent images, which is critical for databases, email systems, and Active Directory. Regular monitoring of VSS writer states, appropriate storage allocation for shadow copies, and scheduled snapshot creation provide a cost-effective layer of rapid recovery for individual files and folders while your full backup solutions handle disaster recovery scenarios.