One of our windows 2008 server is having TLS Version 1.2 Protocol Not Enabled vulnerability.Can someone help me to close this vulnerability.

Details of the vulnerability

We're trying to capture Windows Backup Event log Errors - but the tool forces us to specify the Event Log in question. In my testing, certain Windows Backup event's go into the 'Application' Log (eg: ID 546) while other's go into the 'Microsoft-Windows-Backup\Operational log' (Eg: ID 19).  How can I find out which Log each EVENT ID records to? 

I have a 2012 Essentials server  that currently backs up 8 machines - both desktops and laptops. I now have a MS Surface Pro 4 with Windows 10 Pro that I want to backup. I am getting the following error: "An error prevented Backup from creating a snapshot of the volumes on this computer". There is room in the System Reserve partition of 550 mb. The backup service is running on the Surface Pro, the Windows Server client computer backup service is also running. Also, the Surface Pro is using UEFI/GPT. (I am already backing up another laptop that is using UEFI/GPT without an issue.)

Any idea of what the issue might be?

Thanks.

Gene

How to check memory leak from poolmon or other MS tools.

Please share some examples. As not getting much output from Poolmon

I am trying to configure a scheduled system state backup on a Windows 2008 R2 server using the Windows server backup tool. The backup creates a WindowsImageBackup folder on a backup volume using VSS copy, I thought for System state backup Windows backup will create a flat backup file with the bkf extension and not doing image backup. Any idea why this behavior happening for system backup?

Thanks

We're currently running into issues backing up our Windows Server 2012 VMs through the integrated Windows Server Backup utility. Each time the VM attempts to backup to the Shared Network Folder on our QNAP NAS, it generates the following event log on the VM:

Log Name:      Microsoft-Windows-Backup
Source:        Microsoft-Windows-Backup
Date:          2012-12-20 4:02:55 AM
Event ID:      5
Task Category: None
Level:         Error
Keywords:      
User:          SYSTEM
Computer:      TST12.dev.ad
Description:
The backup operation that started at '‎2012‎-‎12‎-‎20T11:00:25.289755100Z' has failed with following error code '0x807800C5' (There was a failure in preparing the backup image of one of the volumes in the backup set.). Please review the event details for a solution, and then rerun the backup operation once the issue is resolved.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">  <System>    <Provider Name="Microsoft-Windows-Backup" Guid="{1DB28F2E-8F80-4027-8C5A-A11F7F10F62D}" />    <EventID>5</EventID>    <Version>3</Version>    <Level>2</Level>    <Task>0</Task>    <Opcode>0</Opcode>    <Keywords>0x4000000000000000</Keywords>    <TimeCreated SystemTime="2012-12-20T11:02:55.974675700Z" />    <EventRecordID>29</EventRecordID>    <Correlation />    <Execution ProcessID="5312" ThreadID="3776" />    <Channel>Microsoft-Windows-Backup</Channel>    <Computer>TST12.dev.ad</Computer>    <Security UserID="S-1-5-18" />  </System>  <EventData>    <Data Name="BackupTemplateID">{929C5B37-29BF-46B2-B72B-C2819B13EB6D}</Data>    <Data Name="HRESULT">0x807800c5</Data>    <Data Name="DetailedHRESULT">0x8078004f</Data>    <Data Name="ErrorMessage">%%2155348165</Data>    <Data Name="BackupState">12</Data>    <Data Name="BackupTime">2012-12-20T11:00:25.289755100Z</Data>    <Data Name="BackupTarget">\\BMC-NAS1\Backups</Data>    <Data Name="NumOfVolumes">2</Data>    <Data Name="VolumesInfo">&lt;VolumeInfo&gt;&lt;VolumeInfoItem Name="System Reserved" OriginalAccessPath="" State="12" HResult="-2139619249" DetailedHResult="0" PreviousState="9" IsCritical="1" IsIncremental="0" BlockLevel="1" HasFiles="0" HasSystemState="1" IsCompacted="0" IsPruned="0" IsRecreateVhd="0" FullBackupReason="2" DataTransferred="0" NumUnreadableBytes="0" TotalSize="0" TotalNoOfFiles="0" Flags="554" BackupTypeDetermined="1" SSBTotalNoOfFiles="0" SSBTotalSizeOnDisk="0" /&gt;&lt;VolumeInfoItem Name="C:" OriginalAccessPath="C:" State="15" HResult="-2139619228" DetailedHResult="0" PreviousState="0" IsCritical="1" IsIncremental="0" BlockLevel="1" HasFiles="0" HasSystemState="1" IsCompacted="0" IsPruned="0" IsRecreateVhd="0" FullBackupReason="2" DataTransferred="0" NumUnreadableBytes="0" TotalSize="0" TotalNoOfFiles="0" Flags="1576" BackupTypeDetermined="1" SSBTotalNoOfFiles="0" SSBTotalSizeOnDisk="0" /&gt;&lt;/VolumeInfo&gt;</Data>    <Data Name="SourceSnapStartTime">2012-12-20T11:00:25.258548500Z</Data>    <Data Name="SourceSnapEndTime">2012-12-20T11:00:43.682705500Z</Data>    <Data Name="PrepareBackupStartTime">&lt;TimesList&gt;&lt;Time Time="2012-12-20T11:00:53.011Z" /&gt;&lt;Time Time="1601-01-01T00:00:00.000Z" /&gt;&lt;/TimesList&gt;</Data>    <Data Name="PrepareBackupEndTime">&lt;TimesList&gt;&lt;Time Time="2012-12-20T11:00:53.058Z" /&gt;&lt;Time Time="1601-01-01T00:00:00.000Z" /&gt;&lt;/TimesList&gt;</Data>    <Data Name="BackupWriteStartTime">&lt;TimesList&gt;&lt;Time Time="2012-12-20T11:00:53.074Z" /&gt;&lt;Time Time="1601-01-01T00:00:00.000Z" /&gt;&lt;/TimesList&gt;</Data>    <Data Name="BackupWriteEndTime">&lt;TimesList&gt;&lt;Time Time="1601-01-01T00:00:00.000Z" /&gt;&lt;Time Time="1601-01-01T00:00:00.000Z" /&gt;&lt;/TimesList&gt;</Data>    <Data Name="TargetSnapStartTime">1601-01-01T00:00:00.000000000Z</Data>    <Data Name="TargetSnapEndTime">1601-01-01T00:00:00.000000000Z</Data>    <Data Name="DVDFormatStartTime">&lt;TimesList&gt;&lt;/TimesList&gt;</Data>    <Data Name="DVDFormatEndTime">&lt;TimesList&gt;&lt;/TimesList&gt;</Data>    <Data Name="MediaVerifyStartTime">&lt;TimesList&gt;&lt;/TimesList&gt;</Data>    <Data Name="MediaVerifyEndTime">&lt;TimesList&gt;&lt;/TimesList&gt;</Data>    <Data Name="BackupPreviousState">9</Data>    <Data Name="ComponentStatus">&lt;ComponentStatus&gt;&lt;/ComponentStatus&gt;</Data>    <Data Name="ComponentInfo">&lt;ComponentInfo&gt;&lt;/ComponentInfo&gt;</Data>    <Data Name="SSBEnumerateStartTime">1601-01-01T00:00:00.000000000Z</Data>    <Data Name="SSBEnumerateEndTime">1601-01-01T00:00:00.000000000Z</Data>    <Data Name="SSBVhdCreationStartTime">1601-01-01T00:00:00.000000000Z</Data>    <Data Name="SSBVhdCreationEndTime">1601-01-01T00:00:00.000000000Z</Data>    <Data Name="SSBBackupStartTime">1601-01-01T00:00:00.000000000Z</Data>    <Data Name="SSBBackupEndTime">1601-01-01T00:00:00.000000000Z</Data>    <Data Name="SystemStateBackup">&lt;SystemState IsPresent="1" HResult="-2139619131" DetailedHResult="-2139619249" /&gt;</Data>    <Data Name="BMR">&lt;BMR IsPresent="1" HResult="-2139619249" DetailedHResult="0" /&gt;</Data>    <Data Name="VssFullBackup">true</Data>    <Data Name="UserInputBMR">true</Data>    <Data Name="UserInputSSB">true</Data>    <Data Name="BackupSuccessLogPath">C:\Windows\Logs\WindowsServerBackup\Backup-20-12-2012_11-00-25.log</Data>    <Data Name="BackupFailureLogPath">C:\Windows\Logs\WindowsServerBackup\Backup_Error-20-12-2012_11-00-25.log</Data>    <Data Name="EnumerateBackupStartTime">&lt;TimesList&gt;&lt;Time Time="1601-01-01T00:00:00.000Z" /&gt;&lt;Time Time="1601-01-01T00:00:00.000Z" /&gt;&lt;/TimesList&gt;</Data>    <Data Name="EnumerateBackupEndTime">&lt;TimesList&gt;&lt;Time Time="1601-01-01T00:00:00.000Z" /&gt;&lt;Time Time="1601-01-01T00:00:00.000Z" /&gt;&lt;/TimesList&gt;</Data>    <Data Name="PruneBackupStartTime">&lt;TimesList&gt;&lt;Time Time="1601-01-01T00:00:00.000Z" /&gt;&lt;Time Time="1601-01-01T00:00:00.000Z" /&gt;&lt;/TimesList&gt;</Data>    <Data Name="PruneBackupEndTime">&lt;TimesList&gt;&lt;Time Time="1601-01-01T00:00:00.000Z" /&gt;&lt;Time Time="1601-01-01T00:00:00.000Z" /&gt;&lt;/TimesList&gt;</Data>    <Data Name="BackupFlags">0x8</Data>    <Data Name="ComponentInfoSummary">&lt;ComponentInfoSummary ComponentInfoArrayPresent="1" TotalComponents="0" SucceededComponents="0" /&gt;</Data>  </EventData></Event>

All our VMs running Windows Server 2008 R2 backup successfully to this network location using the same network and service credentials. This issue appears to only be happening on our VMs running Windows Server 2012. 

Hello,

There is always some errors events when doing windows server backup even after several times reboots, as below:

"Filter Manager failed to attach to volume '\Device\HarddiskVolume192'.  This volume will be unavailable for filtering until a reboot.  The final status was 0xC03A001C."

The volume number are different, the process ID is always 4 and thread ID is 4444 or 6708.

I have searched on Internet and Microsoft forum, only found the answers about Windows Search service, but actually I already removed this service.

And, already installed all the hot-fixes.

Hope somebody has solution for it.

Best regards.

Bill

Bill

Server 2012R2
Hypervisor with several running VM's
Up2Date 3/18/15

Till sunday wbadmin was running as expected. Backup on monday night results suddenly in 0x807800C5. No changes were made to the system.

I restored a file succesfull from the disk to verify that the disk and the image is ok.

I run wbadmin from a script with:

wbadmin.exe start backup -quiet -backupTarget:f:\ -vssFull -allCritical -hyperv:Seescb-DOM,Seescb-EXCHG,Seescb-W7,TEST-XP

Output is:

2015-03-18 23:02:17 INF > wbadmin 1.0 - Backup command-line tool
2015-03-18 23:02:17 INF > (C) Copyright 2013 Microsoft Corporation. All rights reserved.
2015-03-18 23:02:17 INF >
2015-03-18 23:02:17 INF > Retrieving volume information...
2015-03-18 23:02:17 INF > Any virtual machines included in the backup will be temporarily placed into a
2015-03-18 23:02:17 INF > saved state when the backup runs.
2015-03-18 23:02:17 INF > This will back up (EFI System Partition),(C:),(\\?\Volume{eec85b55-8110-453a-836c-0653e048467d}\), HyperV\Seescb-DOM, HyperV\Seescb-EXCHG, HyperV\Seescb-W7, HyperV\TEST-XP, HyperV\IPFire to f:\.
2015-03-18 23:02:17 INF > The backup operation to F: is starting.
2015-03-18 23:02:17 INF > Creating a shadow copy of the volumes specified for backup...
2015-03-18 23:02:17 INF > Creating a shadow copy of the volumes specified for backup...
2015-03-18 23:02:17 INF > Creating a shadow copy of the volumes specified for backup...
2015-03-18 23:02:17 INF > Creating a shadow copy of the volumes specified for backup...
2015-03-18 23:02:17 INF > Creating a shadow copy of the volumes specified for backup...
2015-03-18 23:02:17 INF > Creating a shadow copy of the volumes specified for backup...
2015-03-18 23:02:17 INF > Creating a shadow copy of the volumes specified for backup...
2015-03-18 23:02:17 INF > Creating a shadow copy of the volumes specified for backup...
2015-03-18 23:02:17 INF > Creating a shadow copy of the volumes specified for backup...
2015-03-18 23:02:17 INF > Creating a shadow copy of the volumes specified for backup...
2015-03-18 23:02:17 INF > Creating a shadow copy of the volumes specified for backup...
2015-03-18 23:02:17 INF > Creating a shadow copy of the volumes specified for backup...
2015-03-18 23:02:17 INF > Creating a shadow copy of the volumes specified for backup...
2015-03-18 23:02:17 INF > Creating a shadow copy of the volumes specified for backup...
2015-03-18 23:02:17 INF > Windows Server Backup is updating the existing backup to remove files that have
2015-03-18 23:02:17 INF > been deleted from your server since the last backup.
2015-03-18 23:02:17 INF > This might take a few minutes.
2015-03-18 23:02:17 INF > Creating a backup of volume (EFI System Partition) (100.00 MB), copied (0%).
2015-03-18 23:02:17 INF > Summary of the backup operation:
2015-03-18 23:02:17 INF > ------------------
2015-03-18 23:02:17 INF >
2015-03-18 23:02:17 INF > The backup operation stopped before completing.
2015-03-18 23:02:17 INF > The backup operation stopped before completing.
2015-03-18 23:02:17 INF > Detailed error: The specified backup disk cannot be found.
2015-03-18 23:02:17 INF > Log of files successfully backed up:
2015-03-18 23:02:17 INF > C:\Windows\Logs\WindowsServerBackup\Backup-18-03-2015_21-59-34.log
2015-03-18 23:02:17 INF >
2015-03-18 23:02:17 INF > Log of files for which backup failed:
2015-03-18 23:02:17 INF > C:\Windows\Logs\WindowsServerBackup\Backup_Error-18-03-2015_21-59-34.log
2015-03-18 23:02:17 INF >
2015-03-18 23:02:17 INF > There was a failure in preparing the backup image of one of the volumes in the backup set.
2015-03-18 23:02:17 INF > The specified backup disk cannot be found.

EventLog:

The backup operation that started at '?2015?-?03?-?17T19:00:18.874927500Z' has failed with following error code '0x807800C5' (There was a failure in preparing the backup image of one of the volumes in the backup set.). Please review the event details for a solution, and then rerun the backup operation once the issue is resolved.

Logfile wbadmin:

Backup of volume \\?\GLOBALROOT\Device\HarddiskVolume2\ has failed. The specified backup disk cannot be found.

Hi,

I have installed the Windows Server Backup feature several times in Windows Server 2012, but the "Windows Server Backup UI" is missing under the "Administrative Tools" and under the \System32\wbadmin.msc .

Any ideas how to re-create or workaround this problem ?

I really appreciate your help !

With kind regards,

Cengiz Kuskaya

My client has a one year old Server 2012 R2 running native Windows backup to external USB backup drives.  Bitlocker is NOT enabled for anything on this server.  A backup drive has been stolen and I am trying to find out what data is available to someone looking at the drive without access to the server itself. I am assuming that the thief does not know the server password or details of how the server was configured with drive letters, etc. What concerns should I have regarding the data on the backup drive?

Thanks!

Dear Supoort Team,

Thank you in advance.

We have using Windows Server 2012 Standard, We have scheduled Backup from Windows Server Backup utility.

Till Last week everything was working fine. But now back not completing and getting following error - "Insufficient storage available to create either the shadow copy.....". I deleted old backups from Diskshadow 143 shadow copies to 47 shadow copies. But in command prompt it showing 47 but not in program. Sharing you snapshots of issue. Please help me to solve this issue.

Thanks & Regards,

Bharat Nabage

I'm testing 2008R2 SP1 Windows Image Backups. Two Servers alpha and omega each have an older backup stored on the other server, in shared folders. In Windows Server Backup - Recovery Wizard - Specify Remote Folder I get to specify the UNC path "to the remote shared folder that contains the backup." Easy, right? I have tried (from \\alpha)

\\omega\WindowsImagebackup    (which is the shared folder)

\\omega\WindowsImagebackup\alpha

\\omega\WindowsImagebackup\alpha\Backup 2011-03-22 133034

These all error with

"The specified remote shared folder does not contain any backup. Provide the path to a remote shared folder that contains backups."

Must be corrupted? But, vice-versa, trying from \\omega and looking at \\alpha i get the same error.

Tell me I'm missing something stupid..  Thanks!

I am trying to set up my new Passport Ultra Metal Edition to back up my server.

When the drive is attached, the system prompts for a driver search and I cannot find a driver for Windows Server 2008 R2.

Any suggestions?

Hi,

We have a networker backup solution in place. Backup fails on one of the windows 2012 server. Event log below. I am not sure how to resolve this issue. Can someone please help?

Log Name:      Application
Source:        VSS
Date:          6/17/2014 5:01:41 PM
Event ID:      8193
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      ---
Description:
Volume Shadow Copy Service error: Unexpected error calling routine GetVolumeNameForVolumeMountPoint is now failing on the volume, winerror 0x00000005. .  hr = 0x80070005, Access is denied.
.

Operation:
   PrepareForSnapshot Event

Context:
   Execution Context: Writer
   Writer Class Id: {e8132975-6f93-4464-a53e-1050253ae220}
   Writer Name: System Writer
   Writer Instance ID: {13f27935-f32a-4e30-bdb6-d87894cecf12}
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="VSS" />
    <EventID Qualifiers="0">8193</EventID>
    <Level>2</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-06-17T15:01:41.000000000Z" />
    <EventRecordID>4864</EventRecordID>
    <Channel>Application</Channel>
    <Computer>
    <Security />
  </System>
  <EventData>
    <Data>GetVolumeNameForVolumeMountPoint is now failing on the volume, winerror 0x00000005. </Data>
    <Data>0x80070005, Access is denied.
</Data>
    <Data>

Operation:
   PrepareForSnapshot Event

Context:
   Execution Context: Writer
   Writer Class Id: {e8132975-6f93-4464-a53e-1050253ae220}
   Writer Name: System Writer
   Writer Instance ID: {13f27935-f32a-4e30-bdb6-d87894cecf12}</Data>
    <Binary>2D20436F64653A20565353415049435030303030313131332D2043616C6C3A20565353415049435030303030313035372D205049443A202030303030303434302D205449443A202030303030313539362D20434D443A2020433A5C57696E646F77735C73797374656D33325C737663686F73742E657865202D6B204E6574776F726B53657276696365202020202020202D20557365723A204E616D653A204E5420415554484F524954595C4E4554574F524B20534552564943452C205349443A532D312D352D3230</Binary>
  </EventData>
</Event>

I'm Using Windows Server backup.

I think there's a bug in the bare-metal restore  (Re-Image) Process in server2016TP5

I have created a Bare-Metal backup from Windows server 2016tp5, into a network shared folder.

The restore (Re-Image) process is loading the installation media, choose repair, and restore the image from the network.

what I did: Loading the Server2016TP5 ISO (Bootable USB), and trying to connect to the shared folder, It failed to connect to the server with the following error: "A specified logon session does not exist. It may already have been terminated (0x80070520)"

I get the same error for Hyper-V Virtual computer, and a Bare Metal (Physical) Server.

Why I think it is a bug ?

I tried to Bare-Metal restore the 2016TP5 with ISO of 2012R2, with exactly the same process (Same network account), it finds the backup files, but I get different error because it can restore Windows 2012R2 only (That error indicate that the backup data is accessible to the 2012R2 Re-Image process

I Also Try to bare-metal backup an restore 2012R2, on the same shared folder (Same account), It worked great on virtual, and Physical system.

can anyone confirm ?

did I do something wrong here ?