Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 36 Source: VolSnap

The shadow copies of volume <volume> were aborted because the shadow copy storage could not grow due to a user imposed limit.
From a support forum:
"Try the following method to fix this issue. Note: Please backup the registry before you modify.
1. Click Start, input regedit, press Enter
2. Locate and then click the following key in the registry:
3. On the Edit menu, point to New, and then click DWORD value.
4. Type MinDiffAreaFileSize, and then press ENTER.
5. On the Edit menu, click Modify.
6. Type the size that you want for the shadow copy storage area, and then click OK.
Reboot the computer to check if it works.
If it doesn't work, please check the disk.
1. Click the Start, input cmd in the search bar.
2. Right-click cmd, run it as Administrator.
3. Input the command: Chkdsk /f /r"
One user reported this blog post as useful in fixing this problem: EV100416 (Restore Points Lost After System Rebooting).
At command prompt, issue command: 'vssadmin list shadowstorage' to check usage, use 'vssadmin resize shadowstorage' to adjust or remove the user limit.
First, check how much free disk space is available on the system volume in Windows Explorer.
- Open Control Panel / System / Advanced System Settings.
- Select the System Protection Tab.
- In the Protection Settings box, select the System Drive (Usually C:).
- Click the Configure Button.
- In the Disk Space Usage section, use the slider to increase the amount of disk space allocated to System Restore.
- Apply/OK.

You can also use the Disk Cleanup tool to remove all but the latest System Restore Points. This will likely give you back a large amount of free disk space.

Go to Start/All Programs/Accessories/System Tools/Disk Cleanup. Select to clean up the files for All Users.

You will have the option of selecting which files to remove.

Select the Clean Up System Files button. This will show a new Tab called More Options. Click this tab and in the System Restore and Shadow Copies section, click the Cleanup Button. This will delete all but the most recent System Restore Point.
From a support forum: "Even though I had used vssadmin to allocate 3% of hdd space, the registry was still showing the default 15% value at the following Registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore\cfg

I simply changed the default value of 15% [0f Hex to 03 Hex] and the issue seems to have cleared up. Apparently vssadmin does not change the default 15% size in the Registry, hence the "shadow copies of volume C: were aborted because the shadow copy storage could not grow due to a user imposed limit" messages in Event Viewer."

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to



Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.