Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 22 Source: VSS

Volume Shadow Copy Service error: A critical component required by the Volume Shadow Copy service is not registered. This might happened if an error occurred during Windows setup or during installation of a Shadow Copy provider. The error returned from CoCreateInstance on class with CLSID {e579ab5f-1cc4-44b4-bed9-de0991ff0623} and Name IVssCoordinatorEx2 is [0x80040154 Class not registered ]. Operation: Instantiating VSS server
According to TE264219, this event can be caused by running backup software containing a 32-bit Volume Shadow Copy service (VSS) requester on a 64-bit version of Windows. The article provides details about a generic troubleshooting approach (how to narrow down the source of the problem).
This event can be recorded with different error codes and operations that caused them so the troubleshooting approach should consider those particular cases, not just any event id 22 from VSS. Examples:

- Error code 0x80040154 (Class not registered), Operation: Instantiating VSS server
- Error code 0x80004002 (No such interface supported), Operation: Creating instance of hardware provider

See also EV100211 (Troubleshooting VSS and Backup).

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to



Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.