System Writer Dissappeared

Posted on 2010-01-10
Medium Priority
Last Modified: 2013-11-29
I'm using Backup Exec 12.5 on SBS 2008 to backup a server remotely. This doesn't use the AOFO at the moment. The remote server environment is a TS with 2008 R2 bit.

I believe the source if this issue is that the System Writer doesn't appear when using VSSadmin List writers.

A Capi2 error is also produced:
Cryptographic Services failed while processing the OnIdentity() call in the System Writer Object.

AddCoreCsiFiles : RtlConvertNtFilePathToWin32Path() failed.

System Error:
0xC0000039 (unresolvable).

I've included the fix I've applied with no avail. I've also uninstalled and reinstalled BE.

I've tried many variations of the included script. I've lodge a PSS case with Microsoft and Symantec. I've installed and remove then re-installed Backup Exec Remote agent. Below is the error I get from Backup Exec:

Backup- TS.Client.com.auV-79-57344-65225 - A failure occurred accessing the Writer metadata.

And further down:
AOFO: Started for resource: "\\TS.Client.au\E:". Advanced Open File Option used: Microsoft Volume Shadow Copy Service (VSS).
The snapshot provider used by VSS for volume E: - Microsoft Software Shadow Copy provider 1.0 (Version
Network control connection is established between [FE80::168B:ADB4:2494:6459%11]:20753 <--> [FE80::2D5E:8B0:A081:EC46%11]:10000
Network data connection is established between    [FE80::168B:ADB4:2494:6459%11]:20758 <--> [FE80::2D5E:8B0:A081:EC46]:51086
V-79-57344-65225 - A failure occurred accessing the Writer metadata.

net stop "System Event Notification Service"
net stop "Background Intelligent Transfer Service"
net stop "COM+ Event System"
net stop "Microsoft Software Shadow Copy Provider "
net stop "Volume Shadow Copy"
cd /d c:\windows\system32 
net stop vss 
net stop swprv 
regsvr32 /s ATL.DLL
regsvr32 /s comsvcs.DLL
regsvr32 /s credui.DLL
regsvr32 /s CRYPTNET.DLL
regsvr32 /s CRYPTUI.DLL
regsvr32 /s dhcpqec.DLL
regsvr32 /s dssenh.DLL
regsvr32 /s eapqec.DLL
regsvr32 /s esscli.DLL
regsvr32 /s FastProx.DLL
regsvr32 /s FirewallAPI.DLL
regsvr32 /s kmsvc.DLL
regsvr32 /s lsmproxy.DLL
regsvr32 /s MSCTF.DLL
regsvr32 /s msi.DLL
regsvr32 /s msxml3.DLL
regsvr32 /s ncprov.DLL
regsvr32 /s ole32.DLL
regsvr32 /s OLEACC.DLL
regsvr32 /s OLEAUT32.DLL
regsvr32 /s PROPSYS.DLL
regsvr32 /s QAgent.DLL
regsvr32 /s qagentrt.DLL
regsvr32 /s QUtil.DLL
regsvr32 /s raschap.DLL
regsvr32 /s RASQEC.DLL
regsvr32 /s rastls.DLL
regsvr32 /s repdrvfs.DLL
regsvr32 /s RPCRT4.DLL
regsvr32 /s rsaenh.DLL
regsvr32 /s SHELL32.DLL
regsvr32 /s shsvcs.DLL
regsvr32 /s /i swprv.DLL
regsvr32 /s tschannel.DLL
regsvr32 /s USERENV.DLL
regsvr32 /s vss_ps.DLL
regsvr32 /s wbemcons.DLL
regsvr32 /s wbemcore.DLL
regsvr32 /s wbemess.DLL
regsvr32 /s wbemsvc.DLL
regsvr32 /s WINHTTP.DLL
regsvr32 /s WINTRUST.DLL
regsvr32 /s wmiprvsd.DLL
regsvr32 /s wmisvc.DLL
regsvr32 /s wmiutils.DLL
regsvr32 /s wuaueng.DLL
sfc /SCANFILE=c:\windows\system32\catsrv.DLL
sfc /SCANFILE=c:\windows\system32\catsrvut.DLL
sfc /SCANFILE=c:\windows\system32\CLBCatQ.DLL
net start "COM+ Event System"

Takeown /f c:\windows\winsxs\filemaps\* /a
icacls c:\windows\winsxs\filemaps\*.* /grant "NT AUTHORITY\SYSTEM:(RX)"
icacls c:\windows\winsxs\filemaps\*.* /grant "NT Service\trustedinstaller:(F)"
icacls c:\windows\winsxs\filemaps\*.* /grant "BUILTIN\Users: (RX)"
icacls c:\windows\winsxs\filemaps\*.* /grant "NT SERVICE\TrustedInstaller:(OI)(CI)(F)" "BUILTIN\Administrators:(OI)(CI)(RX)" "NT AUTHORITY\SYSTEM:(OI)(CI)(RX)" "BUILTIN\Users:(OI)(CI)(RX)"

net start SENS
net start BITS
net start EventSystem
net start swprv
net start VSS

Open in new window

Question by:Michael_Tanner
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 4
  • 3

Author Comment

ID: 26280779
Probably should add this too:

H:\>vssadmin list writers
vssadmin 1.1 - Volume Shadow Copy Service administrative command-line tool
(C) Copyright 2001-2005 Microsoft Corp.

Writer name: 'Task Scheduler Writer'
   Writer Id: {d61d61c8-d73a-4eee-8cdd-f6f9786b7124}
   Writer Instance Id: {1bddd48e-5052-49db-9b07-b96f96727e6b}
   State: [1] Stable
   Last error: No error

Writer name: 'VSS Metadata Store Writer'
   Writer Id: {75dfb225-e2e4-4d39-9ac9-ffaff65ddf06}
   Writer Instance Id: {088e7a7d-09a8-4cc6-a609-ad90e75ddc93}
   State: [1] Stable
   Last error: No error

Writer name: 'Performance Counters Writer'
   Writer Id: {0bada1de-01a9-4625-8278-69e735f39dd2}
   Writer Instance Id: {f0086dda-9efc-47c5-8eb6-a944c3d09381}
   State: [1] Stable
   Last error: No error

Writer name: 'Shadow Copy Optimization Writer'
   Writer Id: {4dc3bdd4-ab48-4d07-adb0-3bee2926fd7f}
   Writer Instance Id: {9e698102-f32a-4668-87d3-3018449ce225}
   State: [1] Stable
   Last error: No error

Writer name: 'ASR Writer'
   Writer Id: {be000cbe-11fe-4426-9c58-531aa6355fc4}
   Writer Instance Id: {4e84206c-2913-4972-940c-c380c0a49f7b}
   State: [1] Stable
   Last error: No error

Writer name: 'Registry Writer'
   Writer Id: {afbab4a2-367d-4d15-a586-71dbb18f8485}
   Writer Instance Id: {de926af7-223c-4d9f-bbdf-9fec043236cb}
   State: [1] Stable
   Last error: No error

Writer name: 'BITS Writer'
   Writer Id: {4969d978-be47-48b0-b100-f328f07ac1e0}
   Writer Instance Id: {1e4ae3dc-c350-4959-81b9-ef6522c83d26}
   State: [1] Stable
   Last error: No error

Writer name: 'COM+ REGDB Writer'
   Writer Id: {542da469-d3e1-473c-9f4f-7847f01fc64f}
   Writer Instance Id: {2d9b593d-deba-45fd-93b3-56a73da04e16}
   State: [1] Stable
   Last error: No error
LVL 32

Expert Comment

ID: 26285979
Can I check if you have run a full "sfc /scannow" check? If not, I would advise to run that.
Did you check the COM permissions manually? - http://technet.microsoft.com/en-us/library/cc734021(WS.10).aspx
In the fix that you explain, I didn't see if you restarted the Cryptographic service - this has been reported to make the System Writer reappear after changing the permissions with icacls (as you show above)

Author Comment

ID: 26289173
The sfc /scannow has been run and I will run it again after hours and give you the report but it didn't seem to change anything

I've manually checked the COM permissions and all seems to be as expected.

I've restarted the Cryptographic service and the entire server itselt. No change. I've obtained and ran all commands and solutions from this forum, which includes restarting the cryptographic service:


I've also looked at the solutions provided in these whitepapers:




It's probably worth noting that this is a brand new build.

Turn your laptop into a mobile console!

The CV211 Laptop USB Console Adapter provides a direct Laptop-to-Computer connection for fast and easy remote desktop access with no software to install.

LVL 32

Accepted Solution

and235100 earned 1000 total points
ID: 26290979
To be honest, what with the specific OS type of SBS 2008, I would never have re-registered all those DLL's. Microsoft do not seem to support this repair method on Vista, 2008 or higher in any case.
Not any help I know - but the best bet really is Microsoft looking into it via PSS - unless someone else has an idea that won't affect the functionality of SBS.

Author Comment

ID: 26299050
I thought it would end up having to go directly to MS as this is a rare and very specific issue.

Magically the backups began to work again. Too bad it was on the day that many registrations and reinstallations occured which doesn't help in figuring out what actually fixed it but never the less II'm pretty happy about it as you would guess.

However, the system writer still isnt listed. Im not sure the purpose of system writer now. I thought it was to do with the system state but that is being backed up fine. Can you please explain to me what the System Writer is used for and (considering the backups are working) if the solution provided below will be likely to have any adverse affects. This solution was provided by Microsoft when I asked is there a way we can manually create/ activate the system writer.

Thanks for all your help and235100 your responses have been most timely :)
Register the following VSS .dlls

Please save the following commands as the .bat file
>> net stop "System Event Notification Service"
>> net stop "COM+ Event System"
>> net stop "Microsoft Software Shadow Copy Provider"
>> net stop "Volume Shadow Copy"
>> cd /d %windir%\system32
>> net stop vss
>> net stop swprv
>> regsvr32 /s ole32.dll
>> regsvr32 /s oleaut32.dll
>> regsvr32 /s vss_ps.dll
>> vssvc /register
>> regsvr32 /s /i swprv.dll
>> regsvr32 /s /i eventcls.dll
>> regsvr32 /s es.dll
>> regsvr32 /s stdprov.dll
>> regsvr32 /s vssui.dll
>> regsvr32 /s msxml3.dll
>> net start "System Event Notification Service"
>> net start "COM+ Event System"
>> net start "Microsoft Software Shadow Copy Provider"
>> net start "Volume Shadow Copy"

Open in new window


Author Closing Comment

ID: 31675353
I'll accept this as the solution since thats what I had to do to fix it anyway.
LVL 32

Expert Comment

ID: 26373082
Thanks. Glad that Microsoft could provide a workable solution.
I have a System Writer listed in "vssadmin list writers" on one of my Server 2008 Enterprise installations that I looked at. It's also showing in Windows 7.
As per the above link - "The Shadow Copy System Writer is used by the cryptographic services provided by the operating system to enumerate and replace system files when the signature of a system file is different from the signature stored in the security catalog database."
All I meant by "I would never have re-registered all those DLL's. Microsoft do not seem to support this repair method on Vista, 2008 or higher in any case." was that  I had read in a Microsoft forum somewhere that a Microsoft employee specifically posted not to re-register DLLs for VSS... (can't find the reference atm.)

Featured Post

Video: Liquid Web Managed WordPress Comparisons

If you run run a WordPress, you understand the potential headaches you may face when updating your plugins and themes. Do you choose to update on the fly and risk taking down your site; or do you set up a staging, keep it in sync with your live site and use that to test updates?

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

When asking a question in a forum or creating documentation, screenshots are vital tools that can convey a lot more information and save you and your reader a lot of time
Ever visit a website where you spotted a really cool looking Font, yet couldn't figure out which font family it belonged to, or how to get a copy of it for your own use? This article explains the process of doing exactly that, as well as showing how…
With the advent of Windows 10, Microsoft is pushing a Get Windows 10 icon into the notification area (system tray) of qualifying computers. There are many reasons for wanting to remove this icon. This two-part Experts Exchange video Micro Tutorial s…
Get a first impression of how PRTG looks and learn how it works.   This video is a short introduction to PRTG, as an initial overview or as a quick start for new PRTG users.

777 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question