This hotfix addresses two specific symptoms:

• Time-out errors occur in Volume Shadow Copy service writers.
• Shadow copies are lost during backup and during times when there are high levels of input/output.

Time-out errors occur in Volume Shadow Copy service writers

Sometimes, during the backup process, some Volume Shadow Copy service writers might fail because of time-out errors that cause the backup to fail. A Volume Shadow Copy service writer is a program or a service that uses Volume Shadow Copy service to save information to a shadow copy storage area. For example, when you use the NTBackup program, the backup may not be successful, and you may receive the following error message: To diagnose the Volume Shadow Copy service writer problem, run the vssadmin command immediately after the backup failure:

1. Click Start, and then click Run.
2. Type vssadmin list writers.

This command lists the Volume Shadow Copy service writers and the current state of each writer. For example, the output might indicate that the Microsoft SQL Server Desktop Engine (MSDE) or the Microsoft Active Directory directory service writer failed. You may experience time-out errors on several writers, including the MSDE writer, the SQL writer, the New Technology Directory Service (NTDS) writer, the Windows Internet naming system (WINS) writer, the Dynamic Host Configuration Protocol (DHCP) writer, the Remote Storage writer, the certification authority writer, and the Microsoft Exchange writer. The following is sample output: Additionally, certain time-out errors can be identified by looking in the application event log. Some examples:

Shadow copies are lost during backup and during times when there are high levels of input/output

Another related symptom is that shadow copies of shared network folders may have been deleted. When this problem occurs, the following event error is logged: In the message, VolumeName is the name of the volume that is scheduled for backup.

The symptoms that are described earlier in this article may occur for one of the following reasons:

• Volume Shadow Copy service writer time-out
• Shadow copy deletion
• Large audit log

Volume Shadow Copy service writer time-out

You may experience a problem that causes certain Volume Shadow Copy service writers to time out during a lengthy shadow copy creation. This problem occurs especially on computers that have slow hard disks, low memory, or low CPU speed; or on computers that have the disk write cache disabled (for example, on a domain controller computer).

Shadow copy creation includes a complex sequence of inter-process calls. The inter-process calls make sure that all the important Volume Shadow Copy service writers (programs such as SQL, Exchange Server, operating system services, and others) flush their data buffers during shadow copy creation. Also, some Volume Shadow Copy service writers, like the Exchange writer, wait to write for a predefined time interval so the shadow copy can be created during the time interval. The writers wait to write so the contents of the shadow copy will be consistent with their data buffers. However, if there is low CPU speed, high memory usage, or high input/output levels, you may experience the following behaviors:

• The writers do not flush their data buffers.
• The writers do not wait the time interval before they write.

When this problem occurs, shadow copy creation fails.

Important Volume Shadow Copy service writers may fail with similar errors because of other conditions. These conditions include a lack of disk space or improper configuration of the computer. This hotfix addresses only the specific timeout errors that might randomly occur in Volume Shadow Copy service writers during backup. You are strongly advised to review the event log for any other potential Volume Shadow Copy service errors that might generate a writer failure.

Shadow copy deletion

You may also experience a problem in the Volsnap.sys driver that causes shadow copy deletion when there is a high level of input/output, especially when the disk write cache is disabled (for example, on a domain controller computer).

By default, the shadow copy provider that is included in Microsoft Windows Server 2003 is used to create shadow copies for backup purposes. The shadow copies are implemented by using a copy-on-write implementation. The differences are also copied in the shadow copy storage area. In Volume Shadow Copy service, you can use the shadow copy management tool, or you can use the vssadmin command.

In the original released version of Windows Server 2003, the initial shadow copy storage area that is allocated for shadow copy creation is 100 megabytes (MB). However, the actual space that is used is much smaller. As time passes, the allocated space may increase as more data is modified on the original volume. However, when you have high input/output traffic on the original volume, the shadow copy storage area cannot grow fast enough to hold all the copy-on-write changes. This causes deletion of all the shadow copies on the original volume. This problem is more noticeable in domain controller configurations. By default, the disk write cache is disabled in domain controller configurations.

Important A similar problem is caused by defragmenting a volume with small cluster size, where all shadow copies are deleted, and where the event log error that is listed earlier in this article is logged. For additional information about losing shadow copies during a disk defragmentation, click the following article number to view the article in the Microsoft Knowledge Base: Also, event error ID 2004 may be logged when there are corrupted NTFS file system volumes. To determine if this is the problem, run the Chkdsk.exe program with the /f switch.

Large audit log

Writer time-out errors might also appear during a system-state backup if the audit log is extremely large. It is best to back up or to clean the audit log periodically.

Important The hotfix that is described in the "Hotfix information" section is included in the update that is described in the following Microsoft Knowledge Base article:
It is highly recommended that you install this update to resolve the problem described in this article and other VSS-related issues.

Hotfix information

To resolve this problem, obtain the latest service pack for Windows Server 2003. For more information, click the following article number to view the article in the Microsoft Knowledge Base: A supported hotfix is available from Microsoft. However, this hotfix is intended to correct only the problem that is described in this article. Apply this hotfix only to systems that are experiencing this specific problem. This hotfix might receive additional testing. Therefore, if you are not severely affected by this problem, we recommend that you wait for the next software update that contains this hotfix.

If the hotfix is available for download, there is a "Hotfix download available" section at the top of this Knowledge Base article. If this section does not appear, contact Microsoft Customer Service and Support to obtain the hotfix.

Note If additional issues occur or if any troubleshooting is required, you might have to create a separate service request. The usual support costs will apply to additional support questions and issues that do not qualify for this specific hotfix. For a complete list of Microsoft Customer Service and Support telephone numbers or to create a separate service request, visit the following Microsoft Web site: Note The "Hotfix download available" form displays the languages for which the hotfix is available. If you do not see your language, it is because a hotfix is not available for that language.

Prerequisites

No prerequisites are required.

Restart requirement

You must restart your computer after you apply this hotfix.

Hotfix replacement information

This hotfix does not replace any other hotfixes.

File information

The English version of this hotfix has the file attributes (or later file attributes) that are listed in the following table. The dates and times for these files are listed in Coordinated Universal Time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time item in Control Panel.

Windows Server 2003, Microsoft Windows Small Business Server 2003

Windows Server 2003, 64-bit editions

Important This section, method, or task contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, click the following article number to view the article in the Microsoft Knowledge Base:

This hotfix makes some classes of writer (SQL, Active Directory, and others) less likely to experience time-out errors. In part, this hotfix is designed to improve the performance of the default shadow copy driver (Volsnap.sys) when there are high input/output levels. The hotfix also includes a larger initial size for the shadow copy storage area: 300 MB instead of 100 MB. Additionally, if a 300 MB initial size is not sufficient, and if shadow copies are still lost because of high input/output levels, this hotfix includes a way for you to configure the initial size of the shadow copy storage area when the shadow copy storage area is created. You can configure the initial size of the shadow copy storage area by using the configurable registry key setting that this hotfix provides.

Follow these steps, and then quit Registry Editor:

1. Click Start, click Run, type regedit, and then click OK.
2. Locate and then click the following key in the registry:
   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VolSnap
3. On the Edit menu, point to New, and then click DWORD value.
4. Type MinDiffAreaFileSize, and then press ENTER.
5. On the Edit menu, click Modify.
6. Type the size that you want for the shadow copy storage area, and then click OK.

The registry key specifies the minimum size of the shadow copy storage area; the default setting is 300 MB, and the maximum setting is 3 gigabytes (GB). For an accurate setting, specify a value that is a multiple of 300 MB; otherwise, the next multiple of 300 MB will be chosen. A value of 300 is equal to 300 MB, and a value of 3,000 is equal to 3 GB.

Note Shadow copies may not function correctly if the value of the registry subkey is larger than the maximum size of the shadow copy storage area. For example, if you set the registry setting to 1024 MB, backup software will not generate snapshots of the 200 MB system partition. Therefore, before you create the registry subkey, make sure that the diff area file is larger than 300 MB or that the diff area file is larger than the value that is specified in the registry. Also, make sure that you have at least 300 MB of free space on the shadow copy storage volume.

Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section. This problem was first corrected in Windows Server 2003 Service Pack 1.