Veeam : VSS Error 8194 on server

[CapnPugwash]

Not sure if this should be posted here or in the Server 2008 section...

 

I use Veeam 5.0 to back up my VMware virtual machines. In the events logs of one of my Windows 2008 servers I regularly see this error:

 

ID 8194

Volume Shadow Copy Service error: Unexpected error querying for the IVssWriterCallback interface. hr = 0x80070005, Access is denied.

. This is often caused by incorrect security settings in either the writer or requestor process.

 

The roor occurs twice during the Veeam backup session - once near the start & once near the end. The backup completes successfully.

 

Opening a CMD prompt and running 'vssadmin list writers' returns a list of vss writers with no errors...

 

I don't see this error on other servers...

[glennda]

What account is the Veeam Application Awareness running under?

[CapnPugwash]

Hi,

 

Thanks for the speedy reply!

 

On Veeam, in the job properties, it's set to run under the network admin account - the credentials must be correct otherwise I'd see the VSS error on other servers?

[glennda]

Hi,

 

Thanks for the speedy reply!

 

On Veeam, in the job properties, it's set to run under the network admin account - the credentials must be correct otherwise I'd see the VSS error on other servers?

 

It would, i have seen some very strange things setup!

 

Are you using Mcafee?

[CapnPugwash]

No we use Symantec

[glennda]

No we use Symantec

 

Ok - what applications are running on these machines?

 

I guess that as you are still running 5.0 you never renewed the support?

[CapnPugwash]

Hi,

 

The server is a DC / DNS server. It runs the management services for our MFD's / printers (which are not in use at night) and also hosts some shared files.

 

No we never renewed the service contract (or with VMware either). We are a school and the attitude to spending money is quite often "let's wait until everything has fallen to bits"!

[glennda]

Hi,

 

The server is a DC / DNS server. It runs the management services for our MFD's / printers (which are not in use at night) and also hosts some shared files.

 

No we never renewed the service contract (or with VMware either). We are a school and the attitude to spending money is quite often "let's wait until everything has fallen to bits"!

Ok,

 

Try this

Here's the solution (Thanks to deajan)

 

Cobian's service is launched as localsystem or as a system service. When using Cobian as system service, it actually acts under a user account which is granted network service activity.

 

The thing is that VSS operations are performed as NT AUTHORITY\Network Service which is not granted COM access.

 

You can get this granted by launching dcomcnfg.exe, browsing to to Component Services, Computers, and right clicking on your Computer. Get to the COM security tab, and grant Network Service (or SERVICE RÉSEAU in french) local access.

 

This should get rid of your Acces denied messages by VSS.

 

Additionnaly, you can grant Network Service full control over HKLM\SYSTEM\CurrentControlSet\Services\VSS\Diag

 

You can also check this key HKLM\SYSTEM\CurrentControlSet\Services\VSS\VssAccessControl which should at least contain the DWORD "NT Authority\NetworkService" set to value 1.

 

You may also add a new DWORD like "DOMAIN\MyCobianServiceUserAccount" and set its value to 1.

 

Stolen from EventID 8194 IVssWriterCallback interface. hr = 0x80070005 - Cobian Backup FAQ - Cobian Backup

[CapnPugwash]

Thanks for that - I doubt I'll get chance to try it out until Early next week but once I do I'll post back & let you know whether it resolved the issue

[CapnPugwash]

Yep - "You can get this granted by launching dcomcnfg.exe, browsing to to Component Services, Computers, and right clicking on your Computer. Get to the COM security tab, and grant Network Service" resolved the issue

 

Cheers!