Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 12292 Source: VSS

Volume Shadow Copy Service error: Error creating the Shadow Copy Provider COM class with CLSID {<CLSID>} [<error code>].
CLSID 3e02620c-e180-44f3-b154-2473646e4cb8, error 0x80040154, Class not registered - We are receiving this message on a Windows 2012 R2 server running on a VMware host. Windows event ids 22 and 8194 from VSS are recorded as well. The event is triggered by an attempt to create a vhdx image of the C: drive using the disk2vhd.exe tool. Various support forums report similar error messages triggered by different backup applications running on virtualized servers. EV100656 (Troubleshooting Volume Shadow Copy (VSS) quiesce related issues) provides some suggestions on troubleshooting VSS on guests running on VMware.

Attempting to run the disk2vhd tool manually with the "Use Volume Shadow Copy" option checked resulted in an error: "Error snapshotting volumes". However, after unchecking the Use Volume Shadow Copy option the tool worked fine and a vhdx image of the C: drive was created without errors.
See EV100447 (How to: Resolve errors 13 and 12292 on Volume Shadow Copy) if you get this error on a Windows 2012 Server with a RAID controller.
Error code 0x80070422: See EV100448 (Fixing Volume Shadow Copy Service Error).
I had this same issue and not letting things like a backup of a system state run, as well as not letting vmware converter push a snapshot etc. I figured out what it was. It was a 3rd party VSS writer (Acronis software). I removed the writer from the registry and it's working now.

Others can cause the same issue, doesn't have to be Acronis.

HKey Local Machine\System\Current Control Set\Services\Vss\Providers
In my case (Windows 2008 SP2) the recommended checks were all ok and just the Microsoft Shadow Copy provider installed. Other symptoms: event was preceded by VSS Event Id:13 followed by VSS Event Ids 34 and 8193. Error code 0x8007008.

Solved by recreating the entire shadow copy space. Run the following:

vssadmin list shadowstorage - This lists your current settings

vssadmin Delete ShadowStorage /For=C: /On=D: - Delete the current shadow copy storage space. You'll loose all snapshots! Modify the paramters to your needs.

vssadmin Add ShadowStorage /For=C: /On=D: /MaxSize=1024MB - recreate the shadow copy space

I had this error on Windows 2003 when 2 services were “Disabled”, namely "Microsoft Software Shadow Copy Provider" and "Volume Shadow Copy".
I have found this error can also appear if the "Microsoft Software Shadow Copy Provider" service is not started.
- Error: 0x80040154 - ME246499 disscuses a problem related to this error code and COM+.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to



Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.