1.    6 Days Ago #1
    Join Date : Apr 2017
    Tennessee
    Posts : 43
    Windows 10 Home/64bit

    While creating a backup, I get this Event Viewer error.


    Filter Manager failed to attach to volume '\Device\HarddiskVolume17'. This volume will be unavailable for filtering until a reboot. The final status was 0xC03A001C.

    I have read several reasons why this error is thrown out during a backup, but I haven't found a solution yet. I have tried disabling the Windows Search Service as suggested by another site, but it did not solve the error being generated; so I set it back to its previous state.

    This is the error parameters:

    Log Name: System
    Source: Microsoft-Windows-FilterManager
    Date: 12/6/2017 8:15:47 AM
    Event ID: 3
    Task Category: None
    Level: Error
    Keywords:
    User: SYSTEM
    Computer: DESKTOP-9AETCF4
    Description:
    Filter Manager failed to attach to volume '\Device\HarddiskVolume17'. This volume will be unavailable for filtering until a reboot. The final status was 0xC03A001C.
    Event Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
    <System>
    <Provider Name="Microsoft-Windows-FilterManager" Guid="{F3C5E28E-63F6-49C7-A204-E48A1BC4B09D}" />
    <EventID>3</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2017-12-06T13:15:47.735281300Z" />
    <EventRecordID>19040</EventRecordID>
    <Correlation />
    <Execution ProcessID="4" ThreadID="332" />
    <Channel>System</Channel>
    <Computer>DESKTOP-9AETCF4</Computer>
    <Security UserID="S-1-5-18" />
    </System>
    <EventData>
    <Data Name="FinalStatus">0xc03a001c</Data>
    <Data Name="ExtraStringLength">24</Data>
    <Data Name="ExtraString">\Device\HarddiskVolume17</Data>
    </EventData>
    </Event>


    Any ideas or suggestions are greatly appreciated.
      My ComputerSystem Spec
  2.    6 Days Ago #2
    Join Date : Feb 2016
    Phoenix, AZ
    Posts : 257
    Windows 10 Pro 1709 16299.19

    I would run a CHKDSK on that volume to insure it has no errors.
      My ComputersSystem Spec
  3.    6 Days Ago #3
    Join Date : Apr 2017
    Tennessee
    Posts : 43
    Windows 10 Home/64bit
    Thread Starter

    Quote Originally Posted by storageman View Post
    I would run a CHKDSK on that volume to insure it has no errors.
    I scanned both volumes, meaning both my computer's SSD and external HDD backup volume and both came back with clean results:

    Log Name: Application
    Source: Chkdsk
    Date: 12/6/2017 9:21:46 PM
    Event ID: 26226
    Task Category: None
    Level: Information
    Keywords: Classic
    User: N/A
    Computer: DESKTOP-9AETCF4
    Description:
    Chkdsk was executed in scan mode on a volume snapshot.

    Checking file system on C:
    Volume label is HP.

    Stage 1: Examining basic file system structure ...

    349440 file records processed.

    File verification completed.

    4888 large file records processed.


    0 bad file records processed.


    Stage 2: Examining file name linkage ...

    461 reparse records processed.


    423316 index entries processed.

    Index verification completed.





    461 reparse records processed.


    Stage 3: Examining security descriptors ...
    Security descriptor verification completed.

    36939 data files processed.

    CHKDSK is verifying Usn Journal...

    34501992 USN bytes processed.

    Usn Journal verification completed.

    Windows has scanned the file system and found no problems.
    No further action is required.

    475297863 KB total disk space.
    33225208 KB in 135444 files.
    107168 KB in 36940 indexes.
    475315 KB in use by the system.
    65536 KB occupied by the log file.
    441490172 KB available on disk.

    4096 bytes in each allocation unit.
    118824465 total allocation units on disk.
    110372543 allocation units available on disk.

    ----------------------------------------------------------------------


    Stage 1: Examining basic file system structure ...

    Stage 2: Examining file name linkage ...

    Stage 3: Examining security descriptors ...

    Event Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
    <System>
    <Provider Name="Chkdsk" />
    <EventID Qualifiers="0">26226</EventID>
    <Level>4</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2017-12-07T02:21:46.894738200Z" />
    <EventRecordID>16718</EventRecordID>
    <Channel>Application</Channel>
    <Computer>DESKTOP-9AETCF4</Computer>
    <Security />
    </System>
    <EventData>
    <Data>

    Checking file system on C:
    Volume label is HP.

    Stage 1: Examining basic file system structure ...

    349440 file records processed.

    File verification completed.

    4888 large file records processed.


    0 bad file records processed.


    Stage 2: Examining file name linkage ...

    461 reparse records processed.


    423316 index entries processed.

    Index verification completed.





    461 reparse records processed.


    Stage 3: Examining security descriptors ...
    Security descriptor verification completed.

    36939 data files processed.

    CHKDSK is verifying Usn Journal...

    34501992 USN bytes processed.

    Usn Journal verification completed.

    Windows has scanned the file system and found no problems.
    No further action is required.

    475297863 KB total disk space.
    33225208 KB in 135444 files.
    107168 KB in 36940 indexes.
    475315 KB in use by the system.
    65536 KB occupied by the log file.
    441490172 KB available on disk.

    4096 bytes in each allocation unit.
    118824465 total allocation units on disk.
    110372543 allocation units available on disk.

    ----------------------------------------------------------------------


    Stage 1: Examining basic file system structure ...

    Stage 2: Examining file name linkage ...

    Stage 3: Examining security descriptors ...
    </Data>
    <Binary>005505003EA10200A13C050000000000820100004B0000000000000000000000</Binary>
    </EventData>
    </Event>





    And here is the external HD results:

    Log Name: Application
    Source: Chkdsk
    Date: 12/6/2017 9:25:57 PM
    Event ID: 26226
    Task Category: None
    Level: Information
    Keywords: Classic
    User: N/A
    Computer: DESKTOP-9AETCF4
    Description:
    Chkdsk was executed in scan mode on a volume snapshot.

    Checking file system on E:
    Volume label is My Passport.

    Stage 1: Examining basic file system structure ...

    1792 file records processed.

    File verification completed.

    0 large file records processed.


    0 bad file records processed.


    Stage 2: Examining file name linkage ...

    7 reparse records processed.


    1894 index entries processed.

    Index verification completed.





    7 reparse records processed.


    Stage 3: Examining security descriptors ...
    Security descriptor verification completed.

    51 data files processed.


    Windows has scanned the file system and found no problems.
    No further action is required.

    976727039 KB total disk space.
    241036584 KB in 161 files.
    180 KB in 53 indexes.
    97555 KB in use by the system.
    65536 KB occupied by the log file.
    735592720 KB available on disk.

    4096 bytes in each allocation unit.
    244181759 total allocation units on disk.
    183898180 allocation units available on disk.

    ----------------------------------------------------------------------


    Stage 1: Examining basic file system structure ...

    Stage 2: Examining file name linkage ...

    Stage 3: Examining security descriptors ...

    Event Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
    <System>
    <Provider Name="Chkdsk" />
    <EventID Qualifiers="0">26226</EventID>
    <Level>4</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2017-12-07T02:25:57.020503800Z" />
    <EventRecordID>16720</EventRecordID>
    <Channel>Application</Channel>
    <Computer>DESKTOP-9AETCF4</Computer>
    <Security />
    </System>
    <EventData>
    <Data>

    Checking file system on E:
    Volume label is My Passport.

    Stage 1: Examining basic file system structure ...

    1792 file records processed.

    File verification completed.

    0 large file records processed.


    0 bad file records processed.


    Stage 2: Examining file name linkage ...

    7 reparse records processed.


    1894 index entries processed.

    Index verification completed.





    7 reparse records processed.


    Stage 3: Examining security descriptors ...
    Security descriptor verification completed.

    51 data files processed.


    Windows has scanned the file system and found no problems.
    No further action is required.

    976727039 KB total disk space.
    241036584 KB in 161 files.
    180 KB in 53 indexes.
    97555 KB in use by the system.
    65536 KB occupied by the log file.
    735592720 KB available on disk.

    4096 bytes in each allocation unit.
    244181759 total allocation units on disk.
    183898180 allocation units available on disk.

    ----------------------------------------------------------------------


    Stage 1: Examining basic file system structure ...

    Stage 2: Examining file name linkage ...

    Stage 3: Examining security descriptors ...
    </Data>
    <Binary>00070000E10000007F0100000000000007000000000000000000000000000000</Binary>
    </EventData>
    </Event>


    I'm in need of further possibilities to resolve this issue. Since the first event log error points to a SYSTEM generated error, I'm wondering if a simple adjustment of permissions would solve this. When I look at the properties of the first error, I don't see my username listed as a possibility to take ownership of the flagged ID. I don't want to mess with the permissions until someone actually knows how to set them with a tutorial for this particular generated SYSTEM error.
    Last edited by EyeInTheSky; 6 Days Ago at 21:54. Reason: Additional thoughts.
      My ComputerSystem Spec
  4.    5 Days Ago #4
    Join Date : Apr 2017
    Tennessee
    Posts : 43
    Windows 10 Home/64bit
    Thread Starter

    I found a solution.


    After reviewing the event error logs more closely, I found that the Event ID 3 (FilterManager) error was pointing towards a registry key. The key looks like this:

    {F3C5E28E-63F6-49C7-A204-E48A1BC4B09D}

    I found that particular key employing its template in three different locations in my registry. First, I made an export of each key to a folder on my desktop just in case deleting them would cause instability on my system, then I went ahead and deleted them from my registry.

    I want to point out that the three registry key entries at {F3C5E28E-63F6-49C7-A204-E48A1BC4B09D} were the FilterManagement key, AutoLogger key and something to do with an outdated system driver key. It was obvious to me that these registry entries were causing the event viewer to flag my external HDD as a virtual disk instead of a removable drive.

    So long story short, I deleted the key entries from the registry and this is what I got:

    Click image for larger version. 

Name:	backing up.jpg 
Views:	8 
Size:	22.5 KB 
ID:	167140

    Click image for larger version. 

Name:	backup successful.jpg 
Views:	8 
Size:	21.4 KB 
ID:	167141

    Click image for larger version. 

Name:	event log clean.JPG 
Views:	0 
Size:	52.9 KB 
ID:	167142

    The error was unable to regenerate itself, and my system is completely stable.

    As a side note, if you have this FilterManager error in your event viewer with error ID 3, see if the above registry key is listed in detail in your event error log report itself. If it is, your registry key may be a different value; but I bet it is what's triggering the event error in the event viewer. If you know how to export your registry keys and you have a system image of your current working OS, then and only then would I recommend trying to tackle this event log error.

    Every place I found this: {F3C5E28E-63F6-49C7-A204-E48A1BC4B09D} in the registry, I right clicked on it and deleted it from the left hand column in the registry; only after first exporting the key to a safe place in case I had to put it back.

    I'm marking this as solved.
    Last edited by EyeInTheSky; 5 Days Ago at 10:33. Reason: Tactical error.
      My ComputerSystem Spec

 


Similar Threads
Thread Forum
W10 Creators update Event viewer error Event ID 360
I have updated Windows 10 Pro to the Creators update. I have had a few event viewer errors which I managed to fix. But I don't know what this one is, I guess everyone is seeing it, does anyone knoe how is it resolved? Thanks. "Windows Hello for...
General Support
Error in Event Viewer
I have an entry in Event Viewer related to TCP Sharing... The NetTcpActivator service depends on the NetTcpPortSharing service which failed to start because of the following error: The service cannot be started, either because it is disabled or...
General Support
Solved Event Error ID 10016 in Event Viewer...
Windows 10 Home 64 bit ASUS X540LA Notebook What is going on here and what is the best for dealing with this? The AppID seems to be designating RuntimeBroker, but I have done everything so far to correct this error. What am I missing? Log...
Performance & Maintenance
Solved Event Viewer error
I have 599 errors of this. I have run SFC /Scannow and Dism /Online /Cleanup-Image /RestoreHealth. It didn't find any errors. I have Googled and searched here and can not find a fix. Is this something to worry about? 75134
Performance & Maintenance
Event ID 5 Kernel-General error in Event Viewer
Welcome, I have a problem. Every day I have this error in event viewer, system log: {Registry Hive Recovered} Registry hive (file):\??\C:\ProgramData\Malwarebytes\Malwarebytes...
AntiVirus, Firewalls and System Security
Our Sites
Site Links
About Us
Windows 10 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 10" and related materials are trademarks of Microsoft Corp.

Designer Media Ltd
All times are GMT -5. The time now is 08:13.
Find Us
Twitter Facebook Google+ Ten Forums iOS App Ten Forums Android App



Windows 10 Forums