asked on

How to use SUBINACL tool to reset specific VSS registry key causing 8193 eventID in Application Log

Currently having a backup issue with a specific backup solution we use by a specific vendor - and the case owner is hung up on a VSS 8193 error that's being logged in the event viewer application log. The error is only logged on a reboot of the server and/or a restart of the "cryptographic" service on the server - is documented to not cause issues with backups - is being logged on every other server we support that do not have issues with backup using this same vendor solution - and at this point I'm stuck in getting further support until I get this 8193 issue resolved.

Following is the Microsoft article referencing this issue and the fix. The solution involves using a *subinacl* tool to reset a specific VSS registry subkey - back to the correct permissions as set before the key was modified when the DHCP role was configured on the server.

https://support.microsoft.com/en-za/help/2298620/vss-eventid-8193-is-logged-when-you-restart-the-cryptographic-services

I've not used this tool before so want to run this by the experts on this forum to make sure I have this process correctly understood before implementing. This will be implemented on Server 2012 up to Server 2019.

If someone might be able to provide a step-by-step, would be most appreciated - thanks much..

Peter Hutchison

Subinacl is a very old command. Try the new SetACL command instead:
https://helgeklein.com/setacl/

hwtech

ASKER

Thanks Peter - I've actually used Helge Klein's delprof2 before...so somewhat familiar with some of their programs.

What I'm looking for is some guidance on how to format the batch script (I'm assuming it will be something along the lines of a .bat executable) that will do the registry key reset as shown in the Msoft link in the initial post.

So is what I note below, what I need to do to implement the fix as noted in the referenced Microsoft article?

Per this excerpt in the linked article:

Do I just open notepad | copy/paste the text that is a copy of the text in the graphic I just posted above | save as vss8193.bat | and run from an elevated DOS prompt?

Here's the command text that I'm asking if this is what needs to be copied/pasted into a batch file save with a name of vss8193.bat

C:\subinacl.exe /Subkeyreg System\CurrentControlSet\Services\VSS\Diag /sddl=D:PAI(A;;KA;;;BA)(A;;KA;;;SY)(A;;CCDCLCSWRPSDRC;;;BO)(A;;CCDCLCSWRPSDRC;;;LS)(A;;CCDCLCSWRPSDRC;;;NS)(A;CIIO;RC;;;OW)(A;;KR;;;BU)(A;CIIO;GR;;;BU)(A;CIIO;GA;;;BA)(A;CIIO;GA;;;BO)(A;CIIO;GA;;;LS)(A;CIIO;GA;;;NS)(A;CIIO;GA;;;SY)(A;CI;CCDCLCSW;;;S-1-5-80-3273805168-4048181553-3172130058-210131473-390205191)(A;ID;KR;;;AC)(A;CIIOID;GR;;;AC)S:ARAI

Thanks -

ASKER CERTIFIED SOLUTION

hwtech

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial