Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 12302 Source: VSS

Volume Shadow Copy Service error: An internal inconsistency was detected in trying to contact shadow copy service writers. Please check to see that the Event Service and Volume Shadow Copy Service are operating properly.
I fixed this problem by following a suggestion from a Google Groups discussion. The problem related to the server thinking it was still in the setup process. Modifying HKLM\System\Setup\UpgradeInProgress from 0x1 to 0x0 and then running vssadmin list writers stopped this event from being logged.

After doing this, ntbackup still failed and VSS events 12292 and 20 were logged in the application log.  Following the process in ME941956 solved those issues.
ME940184 solved the problem for me, apparently, a registry key might be corrupted.
the same issue with regard to the Visio key. Had uninstalled Visio, but the separate catalogue key remained - deleted this, and VSS was back and running.
This issue can occur because the VSS system files are not registered. See ME940032 for information on how to solve this problem.

This problem occurs when you uninstall a program that is listed in this registry subkey: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ContentIndex\Catalogs but only the location information is removed from the registry subkey. See ME907574 to solve this problem.
To fix this problem do the following:
1. Backup the follwing regkey: HKLM\Software\Microsoft\EventSystem\{26c409cc-ae86-11d1-b616-00805fc79216}\Subscriptions
2. Erase the regkey
3. Reboot.
4. Verify that things are working by running "vssadmin.exe list writers".

In my case, Microsoft update ME913648 did the trick.
System started experiencing this error repeatedly and all VSS backups would fail. NTBACKUP also could not backup a simple text file.
Running the command “vssadmin list writers” normally returns a long list of writers. The affected system returned nothing for this command. The fix the problem I reregistered ole32.dll. The syntax is as follows: “c:\regsvr32 ole32.dll”.
The server will need to be restarted after this command is executed. Afterwards "vssadmin list writers" returned the proper list and the backup worked again.
From a newsgroup post: "I seem to have solved the problem. Thanks to the “Google Thread”. It seems that when I was beta testing Office 11 (a.k.a. Office 2003), Visio installed a key in the Content Indexing Service creating a separate index catalog for Visio files. When I uninstalled Visio, that key did not go away. Because CISVC was disabled, it never made a difference to content indexing. However, it certainly got on the wrong side of VSS. I deleted “HKLM\SYSTEM\CurrentControlset\Control\ContentIndex\Catalogs\visio” and now VSS seems to run OK. Go figure".

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to



Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.