Windows Server. Setting up shadow copies for shared folders. Solving VSS Problems
This article will discuss the built-in recovery capability of the Windows operating system. It is not uncommon that after installing a program or game, the system stops starting or does not work correctly. In this case, Windows provides recovery by returning to the previous state.
System restore is a component of the Windows operating system designed to restore the functionality of the OS by rolling back system files, registry keys, and installed programs.
Windows optimization myth
Most users believe that not doing a system restore can save system resources, such as RAM and hard drive space. Alas, this belief was true until progress reached its current scale, for example, the Windows 7 operating system will no longer notice much of a difference “before and after” disabling the services responsible for recovery. It's all about the amount of RAM and hard drives used.
- A system recovery checkpoint is data that stores information about the state and all settings of the operating system, as well as the programs installed on it. A point-in-time recovery checkpoint is created.
In Windows 7, restore points are created automatically: - according to a schedule; - when installing compatible applications and drivers; - when installing Windows Updates; - when restoring the system to one of the previous points. You can also create a restore point manually at any time.
Note ! The amount of disk space allocated for Volume Shadow Copy Service and recovery point storage depends on the capacity of the hard drive partition.
- Volume Shadow Copy is a Windows operating system service that allows you to copy system and locked files that you are currently working with. This service monitors changes across the entire hard drive partition.
Volume Shadow Copy Service keeps 3 percent of the hard drive partition's capacity if it is less than 64 GB and 5 percent or 10 GB if it is larger than 64 GB. When the disk space allocated for the Volume Shadow Copy service runs out, the old points are deleted and replaced with new ones.
You can go to system protection settings by right-clicking on the “Computer” icon on the desktop and selecting “Properties” and “System Protection” in sequence.
In the window that opens, you can configure the protection of previous versions of files together with system settings or separately, the disk space allocated for storing recovery points, or delete recovery points.
Note ! Even if you deleted a file in the Recycle Bin and then emptied it, you have a good chance of restoring it by returning the computer to a previous state. And all this thanks to the volume shadow copy service.
Note! Windows 7 has the ability to control the space allocated for system protection, that is, you can set the maximum amount of disk space for shadow copy storage. Which significantly increases your chances of system recovery.
System Restore can be started in several ways:
- In the Start menu, expand the All Programs list. After that, you need to open the “Standard” folder, and then opening the “System” folder, execute the “System Restore” command
- In the “Backup and Restore” section of the control panel, click “Restore system settings”;
- Open Control Panel - System - System Protection and click the "System Restore" button.
In the “System Restore” window, you can return to the last created restore point or select any other one from the available ones. Here you can find out which programs will be affected by the changes during recovery. To do this, select a restore point and click the “Search for affected programs” button. - You can also run System Restore from the Windows RE (Recovery Environment), which is created automatically during Windows 7 installation and provides the following features: - Automatic Startup Repair fixes problems that prevent Windows 7 from loading. You can use this tool if your boot files are damaged or overwritten by the bootloader of another operating system; - System Restore allows you to return to the point created before the problem occurred. Sometimes this tool also allows you to restore the system startup; System Image Restore is a wizard that walks you through the steps of restoring your system from an image previously created by Windows Backup; - Windows Memory Diagnostic checks your RAM for errors. Typically, a visible manifestation of errors in RAM is a blue screen (BSOD).
- To launch the Windows Recovery Environment after turning on the computer, use the F8 key to enter the menu of additional operating system boot options. By selecting the “Troubleshoot your computer” menu item, we launch the recovery environment, where the first thing we will be asked to do is select a keyboard layout. Select the language in which the administrator password is set. After entering the password, we are taken to a window with recovery options, where we are interested in the second item “System Restore”.
- You can also boot into the recovery environment from the Windows 7 installation disk or a system recovery disk, which you must first create.
- In addition to the above options for accessing recovery functions, there are a number of other options. One of which is the CCleaner program from the Piriform developer company. After installing this universal system optimization and configuration tool, go to the “Service” section in which you will find the “System Restore” item. The latest restore points will be displayed in this area. The table will indicate the name of the point, as well as the date and time. Depending on the version of the program, the event during which the point was created is also possible.
Instead of an afterword
As you can see, standard operating system recovery tools are a good option for constantly monitoring the safety of data. This service is also the key to stable operation. Windows, you shouldn't give up this feature.
If you accidentally deleted a file or folder past the Recycle Bin, don't panic. Data recovery programs are here to stay, so try the system tools first. In Windows, you can restore previous versions of files and folders, even if the GUI does not have this option.
In Windows 8, there is one less tab in the properties of drives, folders and files. Please note that previous versions have disappeared.
This is only observed in the client operating system, i.e. in Windows Server 2012 the tab remains. In Windows 10, the tab is back, but... you need to read the article :)
This article has been updated in the context of Windows 10.
Today on the program
Previous versions on Windows 10
The article was written during the days of Windows 8, and in Windows 10 the “Previous Versions” tab returned to the folder properties. However, the material is relevant for Windows 10 because it demonstrates how to recover files directly from shadow copies.
In Windows 10, the tab says that previous versions are formed from file history and shadow copies. First, you need to consider that in Windows 10, system protection is disabled by default, so with standard settings, previous versions are only available from file history, if it is enabled, of course.
Moreover, my experiment on Windows 10 version 1511 (and later 1709) showed that the tab only shows versions from the file history, even if system protection is enabled!
On this picture:
- Properties of the screenshots folder in the OS. Latest version dated February 27. This is probably the date of the last copy to the file history, which is not working for me right now (the drive is physically disconnected)
- The latest shadow copy dated May 11 (appeared when creating a restore point before installing WU updates), I create a symbolic link to step 3
- Contents of the shadow copy. It can be seen that it contains files created shortly before the appearance of the shadow copy of May 11th. However, they are absent in paragraph 1
Thus, you have the best chance of restoring previous versions if file history is enabled. Then the versions are available on a tab in the folder properties or in the file history interface. Otherwise, system protection must be enabled, and if necessary, you will have to get to shadow copies using the methods described later in the article.
How previous versions work, and why the tab was removed in Windows 8
This picture in the properties of files and folders is only a consequence of the fact that there is no longer a file recovery option in the Windows 8 system protection settings.
I’ll say right away that the absence of an entry point in the graphical interface does not mean the absence of technology in the system. Previous versions of files are still available! Therefore, everything said below is fully applicable to Windows 8, and the description of the technology also applies to Windows 7.
Why was the file protection option and the previous versions tab removed? I don't have a definitive answer, but I have some educated guesses that I'll share with you while also explaining how previous versions work.
On many systems this tab was always empty
This has left thousands of people perplexing community forums and Microsoft support with a burning question. But you already guessed what their problem was, didn’t you? These people had their system protection completely disabled!
People did not understand the principle of storing and displaying previous versions
Indeed, why are there several versions for some folders, and none for others? The fact is that different editions of the files in these folders could only be created no earlier than the oldest recovery point.
Agree, when looking at the tab, it is not entirely obvious that saving versions of personal documents and media files is tied to the creation of recovery points (although this is described in Windows help, albeit not without flaws).
It is common to think of points as a means of rolling back system parameters, especially since personal files are not restored (with the exception of these types of files).
Meanwhile, recovery points and previous versions of files (not related to file history) are stored in one place - volume shadow copies.
System Restore simply takes a snapshot of the volume at the right time and stores it in a shadow copy. It is the space allocated for shadow copies that you control in the system protection settings.
Now it becomes clear why the number of versions of files and folders can vary. The state of the file is recorded at the time the recovery point was created. If it changed between points, its version is saved in the shadow copy. If the file remained unchanged during the period covered by the restore points, it will not have previous versions at all.
Windows 8 introduces file history
Once the technology is used, the benefits can be derived from it. In Windows 7, this was not clear to most people, so in Windows 8 they introduced a more visual data backup system - file history.
It doesn't rely on shadow copies, and you can control the number of file versions by specifying the backup frequency. It all depends on your needs and the space on the target disk.
The access tab to “obscure” previous versions in Windows 8 was simply removed, along with the accompanying option in the system protection settings. As for IT specialists, they should be well acquainted with the concept of shadow copies - after all, server operating systems have a tab of the same name in the volume properties to manage them. Therefore, in Windows Server 2012, the “Previous Versions” tab is in its usual place.
In Windows 8+, restore points are created using a special algorithm, and along with them, previous versions of your files and folders are saved. Next I will tell you how to open them.
How to open previous versions of files and folders from shadow copies
Below are two methods that will work if you have system protection enabled. The first one is suitable for all supported Windows and will be useful if you don't have file history enabled. The second method makes sense only in Windows 8/8.1, taking into account the note about Windows 10 at the beginning of the article.
Method 1 - Symbolic link to shadow copies (Windows 7 and later)
Regular blog readers have already seen this trick in the article about the function of updating a PC without deleting files (Refresh Your PC). It also uses shadow copies to intermediately save the disk when you create your rollback image.
Then I needed this focus to understand the technology, but now you may need it to solve a very specific problem. In a command prompt running as administrator, run:
Vssadmin list shadows
You will see a list of shadow copies on all volumes. Each of them is indicated by a drive letter, so it will be easy for you to navigate. In addition, each shadow copy corresponds by date to one of the recovery points (to list them, run in the console rstrui).
Select the desired date and copy the shadow copy volume ID. Now use it in the second command (don't forget to add a backslash at the end):
Mklink /d %SystemDrive%\shadow \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\
You already have a symbolic link in the root of the system drive shadow, leading to the shadow copy! By following the link, you will see a familiar structure of files and folders - these are their previous versions.
Method 2 - Login to a shared drive over the network (Windows 8 and 8.1)
Added 01/15/2013. In the comments, reader Alexey shared a simpler way to access shadow copies compared to what was originally described in the article. At first the method worked, but later Microsoft closed the loophole with some update. However, Nick's reader eventually suggested a workaround.
First you need to make the disk shared, and then access it “over the network”. In the This PC window, open Network and log into your PC, or as an administrator, paste the network path into the address bar of Explorer or into the Run window:
\\%computername%\C$
where C is the letter of the desired drive. In network folders, the “Previous Versions” tab is present:
Since I've resorted to retrieving data from shadow copies several times, I'm a little sorry for the loss in the GUI. After all, the “Previous Versions” tab was convenient because it immediately allowed you to get to the necessary files.
However, I didn’t use this opportunity so often that entering two commands into the console gave me terrible inconvenience. After all, the main thing is the presence of previous versions of the files, and I can get to them! Now you can too ;)
Have you ever had the opportunity to restore previous versions of files from shadow copies? Tell us in the comments why the need arose and whether you managed to restore everything.
I still think that most readers have never used this feature on home systems, and therefore its disappearance from the GUI will not upset them too much. In the next post, we'll talk about why various Windows features are disappearing or undergoing changes, and what you can do to help change the situation.
This article is designed to clarify service processes and also serve as a guide to Windows settings to resolve problems.
We receive a large number of requests from users having problems with the Volume Shadow Copy Service when using Paragon products. Most products are equipped with Paragon Hot Core technology, which is in no way inferior to Microsoft VSS. Paragon Hot Core has proven itself to be reliable and safe to use. We highly recommend using it instead of VSS.
Enabling Paragon HotCore (HDM15 or earlier only)
This service is not enabled by default during installation, so you must add it manually. Open Control Panel – Programs and Features. Find the product in the list. Select “Edit” in the installation wizard.
Then you need to change the archiving settings as shown in the figure.
The instructions below will help you quickly back up or create a backup copy of locked partitions and drives, even when they are in use.
Volume Shadow Copy Service
The first sign that services have not started is a “reboot required” notification, which means that the program cannot access files that are currently in use. The operation can be carried out after restarting Windows, it will be performed before Windows starts. This scenario is caused by the following two reasons:
Sometimes errors like
This error occurs due to file system or disk errors. This is usually the result of small errors in the file system data. Windows successfully ignores them, but some programs cannot do this. These errors must be corrected using a Windows utility.
1. Check the VSS infrastructure
1.1 Checking VSS providers
Some applications integrate their own VSS providers, causing Microsoft VSS to be disabled entirely. To check providers for activity, enter the following at the command line:
vssadmin list providers
This command displays the name, type, ID, and version of each installed shadow copy service provider.
If more than one provider is installed, you must perform a registry check.
1.2 Checking VSS writers (writers):
There are various VSS writers that create a shadow copy. Incompatibility between them can lead to various problems. To check the writers for problems/errors, enter the following command at the command prompt:
vssadmin list writers
This command displays installed VSS writers and many of the errors reported by them.
1.3 Checking the distribution of shadow copy storage
The partition (selected for shadow copy operations) requires approximately 300 MB of free space and must also be formatted in NTFS. To get information about the shadow copy partition and the used/allocated/maximum available space, enter the following command at the command prompt:
vssadmin list shadowstorage
This command lists all shadow copy storage locations
You can see that partition C: is designated as a shadow copy partition.
1.4 Other VSS commands
delete shadows – deletes shadow copies of a volume;
list shadows – displays existing shadow copies of a volume;
list volumes – displays volumes suitable for creating shadow copies;
resize shadowstorage – allows you to change the size of the shadow copy.
2. Simultaneous archiving:
The MS VSS provider cannot work with multiple shadow copies at the same time. Check if another program is accessing VSS at the same time as it.
3. VSS is supposedly used:
It looks like VSS is in use and is not available. Try checking:
Open the Registry Editor ( regedit.exe) and go to the following path:
HKEY_LOCAL_MACHINE – SYSTEM – Setup
Check if the following items have the value “ 0 “:
SystemSetupInProgress
UpgradeInProgress
4. Some VSS dynamic libraries are corrupted
Make sure all VSS dynamic libraries are installed and registered properly.
Windows XP only
- Open a command prompt
- Enter cd %windir%system32 and press Enter
net stop vss
net stop swprv
regsvr32 ole32.dll
regsvr32 vss_ps.dll
vssvc/Register
regsvr32 /i swprv.dll
regsvr32 /i eventcls.dll
regsvr32 es.dll
regsvr32 stdprov.dll
regsvr32 vssui.dll
regsvr32 msxml.dll
regsvr32 msxml3.dll
regsvr32 msxml4.dll- Restart your computer
Only for Windows 7, Windows 8, Server 2008/R2, Server 2012
- Open a command prompt
- Enter cd %windir%/system32 and press Enter
- Run the following commands in the order listed:
net stop “System Event Notification Service”
net stop “Background Intelligent Transfer Service”
net stop “COM+ Event System”
net stop “Microsoft Software Shadow Copy Provider”
net stop “Volume Shadow Copy”
cd /d %windir%/system32
net stop vss
net stop swprv
regsvr32 /s ATL.DLL
regsvr32 /s comsvcs.DLL
regsvr32 /s credui.DLL
regsvr32 /s CRYPTNET.DLL
regsvr32 /s CRYPTUI.DLL
regsvr32 /s dhcpqec.DLL
regsvr32 /s dssenh.DLL
regsvr32 /s eapqec.DLL
regsvr32 /s esscli.DLL
regsvr32 /s FastProx.DLL
regsvr32 /s FirewallAPI.DLL
regsvr32 /s kmsvc.DLL
regsvr32 /s lsmproxy.DLL
regsvr32 /s MSCTF.DLL
regsvr32 /s msi.DLL
regsvr32 /s msxml3.DLL
regsvr32 /s ncprov.DLL
regsvr32 /s ole32.DLL
regsvr32 /s OLEACC.DLL
regsvr32 /s OLEAUT32.DLL
regsvr32 /s PROPSYS.DLL
regsvr32 /s QAgent.DLL
regsvr32 /s qagentrt.DLL
regsvr32 /s QUtil.DLL
regsvr32 /s raschap.DLL
regsvr32 /s RASQEC.DLL
regsvr32 /s rastls.DLL
regsvr32 /s repdrvfs.DLL
regsvr32 /s RPCRT4.DLL
regsvr32 /s rsaenh.DLL
regsvr32 /s SHELL32.DLL
regsvr32 /s shsvcs.DLL
regsvr32 /s /i swprv.DLL
regsvr32 /s tschannel.DLL
regsvr32 /s USERENV.DLL
regsvr32 /s vss_ps.DLL
regsvr32 /s wbemcons.DLL
regsvr32 /s wbemcore.DLL
regsvr32 /s wbemess.DLL
regsvr32 /s wbemsvc.DLL
regsvr32 /s WINHTTP.DLL
regsvr32 /s WINTRUST.DLL
regsvr32 /s wmiprvsd.DLL
regsvr32 /s wmisvc.DLL
regsvr32 /s wmiutils.DLL
regsvr32 /s wuaueng.DLL
sfc /SCANFILE=%windir%/system32/catsrv.DLL
sfc /SCANFILE=%windir%/system32/catsrvut.DLL
sfc /SCANFILE=%windir%/system32/CLBCatQ.DLL
net start “COM+ Event System” - Restart your computer
5. It also makes sense to check the status of VSS services.
- Open Start, enter Services, press Enter.
- Make sure the following services are installed accordingly:
- Click Services right click, select Properties.
Volume Shadow Copy – “ Manually“;
Microsoft Shadow Copy Software Provider – “ Manually“;
Remote Procedure Call – “ Automatically“;
COM+ Event System – “ Manually" And " Automatically“;
System Event Notification Service – “ Automatically“;
Windows Backup – “ Manually“. - Restart your computer and check if the problem persists.
6. Check if you can create a VSS snapshot directly from Windows
Server OS:
- Open My computer– Right click on any internal partition – Set up shadow copies
- Select the partitions you want to archive and click Create a shadow copy to confirm that there is enough free space on each partition. Otherwise, set the allocation size for the volume.
- You can also use the vssadmin utility to run this check and create, increase, and reallocate space for the shadow copy.
Windows Vista and later workstation operating systems:
- Go to Control Panel –System –System protection
- Select the sections you would like to archive and click the button Create. If necessary, configure volume protection, volume protection, and increase the storage space size.
7. Check Windows Events
Open Start – Execute... – eventvwr.msc. Go to Windows logs – Application and check for error messages related to the VSS service.
Search the articles for solutions Microsoft support, For example, .
8. Virtual machine
If the PC or server you are using is a virtual machine hosting platform, you need to install the latest version VMware Tools(for VMware), Virtual Machine Additions(Virtual Server) on each virtual machine.
9. Windows Updates
Install the latest version Update Packs by using Windows Update.
Check Microsoft support site for patches and other updates to VSS.
10. Archiving exceptions
VSS has pre-selected exceptions that can be modified in the registry to add or remove exceptions and customize the contents of the final archive. Cm. .
The most common problem faced by file server users and administrators is the accidental deletion or overwriting of files. It is very difficult to combat this phenomenon; technical means will not help, and administrative ones often turn out to be ineffective. Very often, employees themselves accidentally overwrite the necessary files. What to do? The answer is simple - configure shadow copies of public folders.
Shadow copying is a special mechanism that allows you to make copies of files corresponding to a certain point in time, even if they are open or locked by the system. Shadow copies allow you to view the contents of public folders as of a particular point in time in the past.
Shadow copies can be used to recover accidentally deleted and accidentally overwritten files, and also allows you to compare multiple versions of the same file. It should be remembered that shadow copies cannot serve as a replacement for backup due to a number of limitations and features that we will discuss below.
Shadow copying is supported by server operating systems starting from Windows Server 2003; client software for working with shadow copies is available starting from Windows XP SP2.
The following limitations should be considered when using shadow copies:
- If the allocated disk space limit is exceeded, old shadow copies will be permanently deleted.
- There can be a maximum of 64 shadow copies per file on a single volume.
- Shadow copying is enabled at the volume level, i.e. You cannot select shared folders and files for which shadow copies will or will not be performed.
- On dual-OS computers, booting an older system or connecting a volume to another PC may cause shadow copies to become corrupted.
Before you set up shadow copying, you should consider your schedule. To do this, you need to analyze user activity and data criticality, finding a compromise between the frequency of creating shadow copies and the period of time that shadow copying should cover. In this case, you should start from the loss of what period of working time can be considered acceptable, and then calculate over what period of time the limit of 64 copies will be reached. It is not recommended to make shadow copies more than once per hour. Also, plan your schedule so that copies are made only during business hours.
To enable shadow copies, go to the snap-in Computer management on the menu Administration.
On the left side of the window, find the item Shared folders and by right clicking select All tasks - Set up shadow copies.
In the window that opens, select the volume on which you will enable shadow copying for shared folders and click Turn on, the first shadow copy will be created immediately.
Then click on the button Options and specify the amount of disk space allocated for storing shadow copies.
The next step is to set a schedule.
Now is the time to test the operation of shadow copies in action. For training purposes, we set a short interval between creating shadow copies and carried out several typical actions with files in a shared folder.
The most common and difficult problem to solve is that the file has been overwritten.
Open the file properties, go to the bookmark Previous versions and select one of the available shadow copies (in our case, only one).
We can open, restore or copy the file. Let's just open it first.
Having made sure that we have the required version of the file, we can restore it or copy it if we need both versions of the files.
To recover deleted files, open the folder properties and select one of its shadow copies, then you can view the files it contains and restore the ones you need. Remember that files from a shadow copy can only be opened as read-only.
As you can see, shadow copying gives users and administrators rich opportunities to work with previous versions of files and folders. This technology, in combination with properly configured backup, allows you to ensure high data availability and reduce the risk of data loss to a reasonable minimum.
We have to admit: mistakes are inevitable, especially when it comes to computers, networks, technology and the people who use it. All users sometimes happen to delete, change or otherwise damage important documents. In such a situation, the opportunity to return everything to the way it was is highly valued. The volume shadow copy mechanism implemented in , allows you to solve the problem in a few mouse clicks - if, of course, it is enabled and configured correctly. Setting up and using this feature is not difficult at all - you just need to know where to look for it.Setting up shadow copying
To be able to use shadow copying, you first need to enable it. Please note that it requires additional system resources, so consider how important the ability to recover files is to you. In most cases, the advantages outweigh the disadvantages, but in some situations the need to allocate additional resources for shadow copying is unacceptable.
Shadow copy settings are contained in the system properties. Open the System tool in Control Panel (Figure A) or enter the keyword "system" ("system" without quotes) in the Start menu search bar.
Figure A. System Properties in Vista.
On the left side of the System window, click the System Protection link (Figure B). Oddly enough, I couldn't find a keyword that would bring up the System Protection window directly from the Start menu search bar. Apparently, we cannot do without an intermediate stage.
Figure B. System Protection link.
In the System Properties dialog box, open the System Protection tab (Figure C) and select the check boxes for the drives for which you want to enable shadow copying. After this, you can immediately create a restore point by clicking the “Create” button. Otherwise, it will be created upon shutdown and next startup.
In this window you can also run a system restore from a previous point, if one exists. After completing the settings, click "OK".
Figure C. System Protection tab
Using Shadow Copy
By setting up shadow copies, you can be sure that important files can be recovered if necessary. As an example, I created a Word 2007 file named "ShadowTest.docx" and saved it in the Documents folder for my profile.
Figure D. My documents.
In Fig. E shows the contents of the file - just one line of text.
Figure E. Text of the "ShadowTest.docx" file.
After saving the document and closing Word, I right-clicked on the file to bring up the properties window and opened the Previous Versions tab. As can be seen from Fig. F, a shadow copy of this document has not yet been created. Under normal conditions, it will appear after shutdown and next startup.
Please note that shadow copying does not eliminate the need for standard file backup, but only complements it. Restoring files from a shadow copy still results in the loss of certain data and is time consuming. It should be used only in extreme cases.
Figure F. File properties.
As an example, I created a restore point to get a shadow copy of the test file (Figure G).
Figure G: New restore point.
Now from the “Previous Versions” tab in the file properties window (Fig. G), you can open a document, copy or restore its previous version. In this case, the current file will be replaced by a shadow copy, which Windows specifically warns about (Fig. H).
