While creating a backup, I get this Event Viewer error.


  1. Posts : 773
    Windows 10 Home x64 - Version 21H2 (OS Build 19044.2006)
       #1

    While creating a backup, I get this Event Viewer error.


    Filter Manager failed to attach to volume '\Device\HarddiskVolume17'. This volume will be unavailable for filtering until a reboot. The final status was 0xC03A001C.

    I have read several reasons why this error is thrown out during a backup, but I haven't found a solution yet. I have tried disabling the Windows Search Service as suggested by another site, but it did not solve the error being generated; so I set it back to its previous state.

    This is the error parameters:

    Log Name: System
    Source: Microsoft-Windows-FilterManager
    Date: 12/6/2017 8:15:47 AM
    Event ID: 3
    Task Category: None
    Level: Error
    Keywords:
    User: SYSTEM
    Computer: DESKTOP-9AETCF4
    Description:
    Filter Manager failed to attach to volume '\Device\HarddiskVolume17'. This volume will be unavailable for filtering until a reboot. The final status was 0xC03A001C.
    Event Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
    <System>
    <Provider Name="Microsoft-Windows-FilterManager" Guid="{F3C5E28E-63F6-49C7-A204-E48A1BC4B09D}" />
    <EventID>3</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2017-12-06T13:15:47.735281300Z" />
    <EventRecordID>19040</EventRecordID>
    <Correlation />
    <Execution ProcessID="4" ThreadID="332" />
    <Channel>System</Channel>
    <Computer>DESKTOP-9AETCF4</Computer>
    <Security UserID="S-1-5-18" />
    </System>
    <EventData>
    <Data Name="FinalStatus">0xc03a001c</Data>
    <Data Name="ExtraStringLength">24</Data>
    <Data Name="ExtraString">\Device\HarddiskVolume17</Data>
    </EventData>
    </Event>


    Any ideas or suggestions are greatly appreciated.
      My Computer


  2. Posts : 1,020
    Windows 10 Pro 20H2 19042.572
       #2

    I would run a CHKDSK on that volume to insure it has no errors.
      My Computers


  3. Posts : 773
    Windows 10 Home x64 - Version 21H2 (OS Build 19044.2006)
    Thread Starter
       #3

    storageman said:
    I would run a CHKDSK on that volume to insure it has no errors.
    I scanned both volumes, meaning both my computer's SSD and external HDD backup volume and both came back with clean results:

    Log Name: Application
    Source: Chkdsk
    Date: 12/6/2017 9:21:46 PM
    Event ID: 26226
    Task Category: None
    Level: Information
    Keywords: Classic
    User: N/A
    Computer: DESKTOP-9AETCF4
    Description:
    Chkdsk was executed in scan mode on a volume snapshot.

    Checking file system on C:
    Volume label is HP.

    Stage 1: Examining basic file system structure ...

    349440 file records processed.

    File verification completed.

    4888 large file records processed.


    0 bad file records processed.


    Stage 2: Examining file name linkage ...

    461 reparse records processed.


    423316 index entries processed.

    Index verification completed.





    461 reparse records processed.


    Stage 3: Examining security descriptors ...
    Security descriptor verification completed.

    36939 data files processed.

    CHKDSK is verifying Usn Journal...

    34501992 USN bytes processed.

    Usn Journal verification completed.

    Windows has scanned the file system and found no problems.
    No further action is required.

    475297863 KB total disk space.
    33225208 KB in 135444 files.
    107168 KB in 36940 indexes.
    475315 KB in use by the system.
    65536 KB occupied by the log file.
    441490172 KB available on disk.

    4096 bytes in each allocation unit.
    118824465 total allocation units on disk.
    110372543 allocation units available on disk.

    ----------------------------------------------------------------------


    Stage 1: Examining basic file system structure ...

    Stage 2: Examining file name linkage ...

    Stage 3: Examining security descriptors ...

    Event Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
    <System>
    <Provider Name="Chkdsk" />
    <EventID Qualifiers="0">26226</EventID>
    <Level>4</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2017-12-07T02:21:46.894738200Z" />
    <EventRecordID>16718</EventRecordID>
    <Channel>Application</Channel>
    <Computer>DESKTOP-9AETCF4</Computer>
    <Security />
    </System>
    <EventData>
    <Data>

    Checking file system on C:
    Volume label is HP.

    Stage 1: Examining basic file system structure ...

    349440 file records processed.

    File verification completed.

    4888 large file records processed.


    0 bad file records processed.


    Stage 2: Examining file name linkage ...

    461 reparse records processed.


    423316 index entries processed.

    Index verification completed.





    461 reparse records processed.


    Stage 3: Examining security descriptors ...
    Security descriptor verification completed.

    36939 data files processed.

    CHKDSK is verifying Usn Journal...

    34501992 USN bytes processed.

    Usn Journal verification completed.

    Windows has scanned the file system and found no problems.
    No further action is required.

    475297863 KB total disk space.
    33225208 KB in 135444 files.
    107168 KB in 36940 indexes.
    475315 KB in use by the system.
    65536 KB occupied by the log file.
    441490172 KB available on disk.

    4096 bytes in each allocation unit.
    118824465 total allocation units on disk.
    110372543 allocation units available on disk.

    ----------------------------------------------------------------------


    Stage 1: Examining basic file system structure ...

    Stage 2: Examining file name linkage ...

    Stage 3: Examining security descriptors ...
    </Data>
    <Binary>005505003EA10200A13C050000000000820100004B0000000000000000000000</Binary>
    </EventData>
    </Event>





    And here is the external HD results:

    Log Name: Application
    Source: Chkdsk
    Date: 12/6/2017 9:25:57 PM
    Event ID: 26226
    Task Category: None
    Level: Information
    Keywords: Classic
    User: N/A
    Computer: DESKTOP-9AETCF4
    Description:
    Chkdsk was executed in scan mode on a volume snapshot.

    Checking file system on E:
    Volume label is My Passport.

    Stage 1: Examining basic file system structure ...

    1792 file records processed.

    File verification completed.

    0 large file records processed.


    0 bad file records processed.


    Stage 2: Examining file name linkage ...

    7 reparse records processed.


    1894 index entries processed.

    Index verification completed.





    7 reparse records processed.


    Stage 3: Examining security descriptors ...
    Security descriptor verification completed.

    51 data files processed.


    Windows has scanned the file system and found no problems.
    No further action is required.

    976727039 KB total disk space.
    241036584 KB in 161 files.
    180 KB in 53 indexes.
    97555 KB in use by the system.
    65536 KB occupied by the log file.
    735592720 KB available on disk.

    4096 bytes in each allocation unit.
    244181759 total allocation units on disk.
    183898180 allocation units available on disk.

    ----------------------------------------------------------------------


    Stage 1: Examining basic file system structure ...

    Stage 2: Examining file name linkage ...

    Stage 3: Examining security descriptors ...

    Event Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
    <System>
    <Provider Name="Chkdsk" />
    <EventID Qualifiers="0">26226</EventID>
    <Level>4</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2017-12-07T02:25:57.020503800Z" />
    <EventRecordID>16720</EventRecordID>
    <Channel>Application</Channel>
    <Computer>DESKTOP-9AETCF4</Computer>
    <Security />
    </System>
    <EventData>
    <Data>

    Checking file system on E:
    Volume label is My Passport.

    Stage 1: Examining basic file system structure ...

    1792 file records processed.

    File verification completed.

    0 large file records processed.


    0 bad file records processed.


    Stage 2: Examining file name linkage ...

    7 reparse records processed.


    1894 index entries processed.

    Index verification completed.





    7 reparse records processed.


    Stage 3: Examining security descriptors ...
    Security descriptor verification completed.

    51 data files processed.


    Windows has scanned the file system and found no problems.
    No further action is required.

    976727039 KB total disk space.
    241036584 KB in 161 files.
    180 KB in 53 indexes.
    97555 KB in use by the system.
    65536 KB occupied by the log file.
    735592720 KB available on disk.

    4096 bytes in each allocation unit.
    244181759 total allocation units on disk.
    183898180 allocation units available on disk.

    ----------------------------------------------------------------------


    Stage 1: Examining basic file system structure ...

    Stage 2: Examining file name linkage ...

    Stage 3: Examining security descriptors ...
    </Data>
    <Binary>00070000E10000007F0100000000000007000000000000000000000000000000</Binary>
    </EventData>
    </Event>


    I'm in need of further possibilities to resolve this issue. Since the first event log error points to a SYSTEM generated error, I'm wondering if a simple adjustment of permissions would solve this. When I look at the properties of the first error, I don't see my username listed as a possibility to take ownership of the flagged ID. I don't want to mess with the permissions until someone actually knows how to set them with a tutorial for this particular generated SYSTEM error.
    Last edited by EyeInTheSky; 06 Dec 2017 at 21:54. Reason: Additional thoughts.
      My Computer


  4. Posts : 773
    Windows 10 Home x64 - Version 21H2 (OS Build 19044.2006)
    Thread Starter
       #4

    I found a solution.


    After reviewing the event error logs more closely, I found that the Event ID 3 (FilterManager) error was pointing towards a registry key. The key looks like this:

    {F3C5E28E-63F6-49C7-A204-E48A1BC4B09D}

    I found that particular key employing its template in three different locations in my registry. First, I made an export of each key to a folder on my desktop just in case deleting them would cause instability on my system, then I went ahead and deleted them from my registry.

    I want to point out that the three registry key entries at {F3C5E28E-63F6-49C7-A204-E48A1BC4B09D} were the FilterManagement key, AutoLogger key and something to do with an outdated system driver key. It was obvious to me that these registry entries were causing the event viewer to flag my external HDD as a virtual disk instead of a removable drive.

    So long story short, I deleted the key entries from the registry and this is what I got:

    While creating a backup, I get this Event Viewer error.-backing-up.jpg

    While creating a backup, I get this Event Viewer error.-backup-successful.jpg

    While creating a backup, I get this Event Viewer error.-event-log-clean.jpg

    The error was unable to regenerate itself, and my system is completely stable.

    As a side note, if you have this FilterManager error in your event viewer with error ID 3, see if the above registry key is listed in detail in your event error log report itself. If it is, your registry key may be a different value; but I bet it is what's triggering the event error in the event viewer. If you know how to export your registry keys and you have a system image of your current working OS, then and only then would I recommend trying to tackle this event log error.

    Every place I found this: {F3C5E28E-63F6-49C7-A204-E48A1BC4B09D} in the registry, I right clicked on it and deleted it from the left hand column in the registry; only after first exporting the key to a safe place in case I had to put it back.

    I'm marking this as solved.
    Last edited by EyeInTheSky; 07 Dec 2017 at 10:33. Reason: Tactical error.
      My Computer


 

  Related Discussions
Our Sites
Site Links
About Us
Windows 10 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 10" and related materials are trademarks of Microsoft Corp.

© Designer Media Ltd
All times are GMT -5. The time now is 07:50.
Find Us




Windows 10 Forums