"Shadow Copies of volume C: aborted" (Event ID 36)...

I noticed a new Error in the Windows System Event Viewer logs, one I haven't seen before. Event ID 36, Source Volsnap: "The shadow copies of volume C: were aborted because the shadow copy storage could not grow due to a user imposed limit."

I don't recall ever setting such a limit... I don't really need shadow copies. I've never made use of them, as I backup my computer to image files on an external hard drive.

That said, I'd like to be able to address the error one way or another.

What should I do? Details of event are below.

Thanks for any info!

- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
<Provider Name="Volsnap" Guid="{cb017cd2-1f37-4e65-82bc-3e91f6a37559}" EventSourceName="volsnap" />

<EventID Qualifiers="49158">36</EventID>

<Version>0</Version>

<Level>2</Level>

<Task>0</Task>

<Opcode>0</Opcode>

<Keywords>0x80000000000000</Keywords>

<TimeCreated SystemTime="2017-02-21T03:54:13.439234600Z" />

<EventRecordID>68672</EventRecordID>

<Correlation />

<Execution ProcessID="4" ThreadID="5268" />

<Channel>System</Channel>

<Computer>DESKTOP-NDLCEAK</Computer>

<Security />

</System>


- <EventData>
<Data Name="DeviceName">\Device\HarddiskVolumeShadowCopy2</Data>

<Data Name="VolumeName">C:</Data>

<Data Name="NTSTATUS">00000000</Data>

<Data Name="SourceTag">164</Data>

<Data Name="SourceFileID">0x0005</Data>

<Data Name="SourceLine">2586</Data>

<Binary>000000000600300000000000240006C0A40000000000000000000000000000000000000000000000</Binary>

</EventData>


</Event>

Hi,


You're running out of disk space.
Right click the start button and select System then System Protection.
Either delete some old restore points or augment the disk space these can occupy.



Cheers,

Thanks for your reply.

I wondered about that, but C:\ shows 80.3 GB free of 154 GB... I have System Restore disabled because I don't use it. Current usage of restore points is 0 bytes. See screen clips.

Not sure what to make of this?

Hi,



System Protection should be set to 0 bytes.
Can you switch it back on, put the slider so it says 0 bytes and then turn it back off?
Restart the machine and check if the setting sticks.



Cheers,

For me, that slider is already at its lowest point. I can't set it to 0% neither with System Protection on, nor with it disabled. It goes from 1% to 100%, no zero... Is that abnormal?

Could it be that I need to increase the slider to 2% or 3% so that shadow copies are not aborted?

Thanks for your help!

Yes, System Protection is turned off for all drives.

Let me know what you are able to find out about this.

Thanks again :)

Hi,

Can you check if File History is turned on ?

Easiest way is through Control Panel.

Cheers,

File History is off. I understand that is the default. I have never turned it on; never used it.

Hi,
Really odd. The error is pretty much self-explanatory but should not occur in your case since System Protection is set to OFF.
However Windows sees it as being in the ON state.
So, I dug into the registry and here's a copy of what mine looks like:
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\volsnap]
"DisplayName"="@%SystemRoot%\\system32\\drivers\\volsnap.sys,-100"
"ErrorControl"=dword:00000003
"ImagePath"=hex(2):53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,64,00,\
72,00,69,00,76,00,65,00,72,00,73,00,5c,00,76,00,6f,00,6c,00,73,00,6e,00,61,\
00,70,00,2e,00,73,00,79,00,73,00,00,00
"Start"=dword:00000000
"Type"=dword:00000001
"Description"="@%SystemRoot%\\system32\\drivers\\volsnap.sys,-101"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\volsnap\Enum]
"0"="STORAGE\\Volume\\{da9ceb32-c6c4-11e6-8b2f-806e6f6e6963}#0000000000100000"
"Count"=dword:00000006
"NextInstance"=dword:00000006
"1"="STORAGE\\Volume\\{da9ceb32-c6c4-11e6-8b2f-806e6f6e6963}#000000001C300000"
"2"="STORAGE\\Volume\\{da9ceb32-c6c4-11e6-8b2f-806e6f6e6963}#0000000022700000"
"3"="STORAGE\\Volume\\{da9ceb32-c6c4-11e6-8b2f-806e6f6e6963}#0000000023700000"
"4"="STORAGE\\Volume\\{da9ceb32-c6c4-11e6-8b2f-806e6f6e6963}#00000008E3B00000"
"5"="STORAGE\\Volume\\{da9ceb32-c6c4-11e6-8b2f-806e6f6e6963}#00000035E3700000"
You can ignore the "Enum" subkey.
This should give you an idea of how it should look like.

If that still does not help then:

From a support forum:
"Try the following method to fix this issue. Note: Please backup the registry before you modify.
1. Click Start, input regedit, press Enter
2. Locate and then click the following key in the registry:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VolSnap
3. On the Edit menu, point to New, and then click DWORD value.
4. Type MinDiffAreaFileSize, and then press ENTER.
5. On the Edit menu, click Modify.
6. Type the size that you want for the shadow copy storage area, and then click OK.
Reboot the computer to check if it works.
If it doesn't work, please check the disk.
1. Click the Start, input cmd in the search bar.
2. Right-click cmd, run it as Administrator.
3. Input the command: Chkdsk /f /r"

Cheers,