Page 7 of 15 FirstFirst ... 56789 ... LastLast
  1.    28 Feb 2017 #61
    Join Date : Aug 2015
    Posts : 575
    Win10 & Win7

    Since this issue with restore points came to light I, and I'm sure others, have been concerned that the reliability of VSS might be comprised as well. This would call into question the reliability of backup software that uses VSS, such as Macrium to create images from within a running session of Windows. I decided to no longer do that and instead use the Macrium rescue USB stick to make full and differential backups until this issue is resolved by MS. Better to be safe than sorry. However, in an effort to resolve the question of VSS still functioning, I've decided that tomorrow morning I'll test one of my PC by using Macrium to run a full image backup from within Windows and then restore it. I'll post the results by mid-morning. I suspect that VSS will continue to function in spite of the restore point issue.

    UPDATE 3/1/2017: Macrium was able to create images of the system (backups: fill, differential, and incremental) from within Windows with no problems. As another member pointed out, Macrium will warn you of any VSS issues before it actually begins writing the backups. FYI, Macrium uses VSS to create a "snapshot" of the volumes that it uses to select the files for backup.
    Last edited by SoFine409; 01 Mar 2017 at 12:10. Reason: New information
      My ComputerSystem Spec
  2.    01 Mar 2017 #62
    Join Date : Oct 2016
    Charlotte, NC
    Posts : 439
    Win10 Home x64 - 1709

    Update on the (event id 4 'wcifs')

    Not sure what/how, but on my laptop I started getting that error again when creating restore points. I looked at the fltmc instances and wcifs was attached to c:: ... So, it appears that auto starting wcifs and the loading of the wcifs filter is not an issue, it's when it gets attached to c: event id 4 'wcifs' shows up. I'm not sure but, I think when it attaches to c: is when it creates the 'wcifs.md' file in the 'c:\system volume infomation' foler. Still haven't found any info that file ???

    I did 'fltmc detach wcifs c:' and I deleted the 'wcifs.md' from the 'c:\system volume information' (NOT sure I really need to delete it) and the error when away again.

    Note: After did the above, on one of my restore tries I got the error about Anti Virus keeping restore from completing 'An unspecified error occurred during System Restore: (WindowsWcifs). Additional information: 0x80070005'. So it would seem that system restore and wcifs are related. I just don't know enough about it to work out the details.

    Note: I was able to disable AVG and Malware Bytes and the restore completed successfully. See my last post post in ''AppxStaging %ProgramFiles%\WindowsApp 0x80070091 on getting to this point .... lol
      My ComputersSystem Spec
  3.    01 Mar 2017 #63
    Join Date : Mar 2017
    Posts : 1
    Win 10 Pro

    Yet another data point, I guess, and it sounds like slightly different behavior. Starting Feb 22, I get the wcifs event id 4 / status 0xC000000D entry as soon as my laptop (Dell XPS13) goes into sleep mode, then within about 30 seconds my Intel igfx video driver immediately begins failing over and over every four seconds ("stopped responding and has successfully recovered") and nothing wakes it up again, I have to do a hard shutdown and reboot.

    Since I can't see the screen at that point, I can't run fltmc, but after reboot it does show wcifs attached to C:
      My ComputerSystem Spec
  4.    01 Mar 2017 #64
    Join Date : Aug 2015
    Posts : 125
    Windows 10 x64

    Sleeping is most probably also connected to VSS. :-/


    Quote Originally Posted by MV10 View Post
    Yet another data point, I guess, and it sounds like slightly different behavior. Starting Feb 22, I get the wcifs event id 4 / status 0xC000000D entry as soon as my laptop (Dell XPS13) goes into sleep mode, then within about 30 seconds my Intel igfx video driver immediately begins failing over and over every four seconds ("stopped responding and has successfully recovered") and nothing wakes it up again, I have to do a hard shutdown and reboot.

    Since I can't see the screen at that point, I can't run fltmc, but after reboot it does show wcifs attached to C:
      My ComputerSystem Spec
  5.    01 Mar 2017 #65
    Join Date : Aug 2015
    Posts : 575
    Win10 & Win7

    [QUOTE=Eagle51;948587]
    So I just decided to manually delete the folders. No problems till I got to the folder "C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_17.7909.7600.0_x64__8wekyb3d8bbwe" ... that I couldn't delete (0x80070091). Taking ownership, granting full user rights, etc didn't help. I found the account DOMAIN\USER permissions were corrupt on some of the folders (specifically the \VFS and its subfolders) and most of the files. Once I was able to get that sorted out and and get that folder deleted, I rebooted (no surprise error/warnings in event viewer), created a new restore point, then restored it successfully.[QUOTE]

    @Eagle51 Could you share with me how you were able to fix the corrupt permissions? The same thing happened to me however the ADD and REMOVE buttons are grayed out so I'm at a loss to know how to proceed. Thanks for any help.
    Bob
      My ComputerSystem Spec
  6.    01 Mar 2017 #66
    Join Date : Oct 2016
    Charlotte, NC
    Posts : 439
    Win10 Home x64 - 1709

    SoFine409 ... I'm NOT recommending what I did as fix.

    The DOMAIN\USERS with the Condition Exists Win://SYSAPPID is suppose to be there. If your going to start messing with permissions on the WindowsApps folder and sub folders, I STRONGLY suggest you get real familiar with ICACLS first. Back the current permissions to a file so can restore them in case you break something (which is very likely when screwing with permissions)

    With that said, you have to take ownership of the folder "C\:Programs Files\WindowsApps"
      My ComputersSystem Spec
  7.    01 Mar 2017 #67
    Join Date : Aug 2015
    Posts : 575
    Win10 & Win7

    Quote Originally Posted by Eagle51 View Post
    SoFine409 ... I'm NOT recommending what I did as fix.

    The DOMAIN\USERS with the Condition Exists Win://SYSAPPID is suppose to be there. If your going to start messing with permissions on the WindowsApps folder and sub folders, I STRONGLY suggest you get real familiar with ICACLS first. Back the current permissions to a file so can restore them in case you break something (which is very likely when screwing with permissions)

    With that said, you have to take ownership of the folder "C\:Programs Files\WindowsApps"
    Thanks Eagle51. I wrote down the steps needed to rename the WindowsApp folder so I can try it on an old laptop that I keep for testing. I'll try it just for fun since I have saved images that I can use to restore it afterwards. I was just messaging with EdTittle and he recommends we use Feedback Hub to ping MS about this. The more heat they get the more likely we'll see a fix. BTW great detective work you and the other members have done. Are you an IT pro?
    Bob
      My ComputerSystem Spec
  8.    01 Mar 2017 #68
    Join Date : Oct 2016
    Charlotte, NC
    Posts : 439
    Win10 Home x64 - 1709

    It dawned on me this morning, that maybe 'wcifs' is working like it's suppose to. When system restore fails, the 'wcifs' filter creates the 'wcifs.md' file in the 'c:\system volume information' folder and when system restore is successful it either deletes it or changes it's content. Once it's created in a failed state (either not deleted or contents changes) that's why we see the error on a reboot.

    Since the contents of the 'wcifs.md' file is not really readable it's hard to tell if it changes (other than by size maybe) and since I just deleted the damn thing in my testing, I can't just put it back to verify.

    Now that I got system restore working, need figure out how to make it fail / complete and try an verify .... lol
      My ComputersSystem Spec
  9.    01 Mar 2017 #69
    Join Date : Aug 2015
    Posts : 575
    Win10 & Win7

    Quote Originally Posted by Eagle51 View Post
    It dawned on me this morning, that maybe 'wcifs' is working like it's suppose to. When system restore fails, the 'wcifs' filter creates the 'wcifs.md' file in the 'c:\system volume information' folder and when system restore is successful it either deletes it or changes it's content. Once it's created in a failed state (either not deleted or contents changes) that's why we see the error on a reboot.

    Since the contents of the 'wcifs.md' file is not really readable it's hard to tell if it changes (other than by size maybe) and since I just deleted the damn thing in my testing, I can't just put it back to verify.

    Now that I got system restore working, need figure out how to make it fail / complete and try an verify .... lol
    It should eventually fail as soon as the Get Office app updates on your PC. Or you could use Macrium and make an image of your OS as it is now and then do a clean install? The clean install would then likely update all the apps and break the restore function again.
      My ComputerSystem Spec
  10.    01 Mar 2017 #70
    Join Date : Oct 2016
    Charlotte, NC
    Posts : 439
    Win10 Home x64 - 1709

    SoFine409 ... probably, but I ain't going down that road again. Nope, not an IT Pro.

    Note: Probably not a valid test.

    I found a 'wcifs.md' file dated 2/20/2017 (1k), with what appears to be one ascii character/symbol in it [] . I think this is the original file, when I first noticed my restore issue, but can't be sure.

    Put it in 'c:\system volume information'
    Created a restore point and got the event id 4 filter manager warning.
    Rebooted and got the event id 4 filter manager warning.

    File System Filter 'wcifs' (Version 10.0, ‎2016‎-‎09‎-‎15T11:42:03.000000000Z) failed to attach to volume '\Device\HarddiskVolumeShadowCopy4'. The filter returned a non-standard final status of 0xC000000D. This filter and/or its supporting applications should handle this condition. If this condition persists, contact the vendor.

    Then did a system restore on the restore point I just created and it completely successfully. That 'wcifys.md' file didn't get deleted or changed and fltmc instances shows wcifs is attached to c: Not sure this really sheds any light on the issue ... lol
      My ComputersSystem Spec

 
Page 7 of 15 FirstFirst ... 56789 ... LastLast


Similar Threads
Thread Forum
Having problems reinstalling some software,WCIFS warning/error
Greets, Everything was running fine until Win10 decided to upgrade itself about two weeks ago. After the upgrade I tried to launch Jasc Paintshop Pro and after a spinning circle nothing happened. Tried launching it with different compatibility...
Software and Apps
Solved Exfat file system Vs NTFS file system...
Hi all, Here is a critical problem i have faced. I have inserted my pendrive in an laptop with OS X. As it was in ntfs format the data were shown but writting into this couldn't be done. So I format it to exfat format to get some data. When I...
Drivers and Hardware
Is Filter Manager Crashing my System w/o BSOD or Errors?
This has happened twice so far, both were the exact same scenario: I have a monitor and a TV, so I set the Extended display option so I can work on the monitor, but have Netflix up on the TV. When I'm done working, I'll just turn off the...
General Support
Hardware & Drivers Block or Unblock Legacy File System Filter Drivers in Windows 10
How to Block or Unblock Legacy File System Filter Drivers in Windows 10 Starting in Windows 10 version 1607, administrators and driver developers can use a registry setting to block legacy file system filter drivers. Legacy file system filter...
Tutorials
Event Viewer TDI filter warning
Hello, I am receiving this error in Event Viewer: A TDI filter (\Driver\adgnetworktdidrv) was detected. This filter has not been certified by Microsoft and may cause system instability. I'm not sure what this means. Is it something that can be...
Performance & Maintenance
Our Sites
Site Links
About Us
Windows 10 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 10" and related materials are trademarks of Microsoft Corp.

Designer Media Ltd
All times are GMT -5. The time now is 03:06.
Find Us
Twitter Facebook Google+ Ten Forums iOS App Ten Forums Android App



Windows 10 Forums