Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 8194 Source: VSS

Volume Shadow Copy Service error: Unexpected error querying for the IVssWriterCallback interface. hr = 0x80070005, Access is denied.
. This is often caused by incorrect security settings in either the writer or requestor process.

Gathering Writer Data

Writer Class Id: {be9ac81e-3619-421f-920f-4c6fea9e93ad}
Writer Name: Dhcp Jet Writer
Writer Instance ID: {d0b63a2d-03d5-4656-8171-25e8062cfa83}

0000: 57 52 54 57 52 54 49 43   WRTWRTIC
0008: 36 34 39 00 00 00 00 00   649.....
0010: 57 52 54 57 52 54 49 43   WRTWRTIC
0018: 36 31 39 00 00 00 00 00   619.....
I had this issue with Server 2012 R2 running the 2011 Essentials service.

According to EV100525 (VSS IVssWriterCallback Error Occurs When Creating Backup), this error is caused by incorrect or missing COM access permissions and does not affect the use of Image for Windows.

These steps worked for me:

1.Press and hold the Windows key and press R to pull up the Run dialog. Alternatively, if Run... is available from the Start Menu you can access it from there.

2.Type dcomcnfg into the box and click OK. The Component Services window will appear.

3.In the left portion of the window, expand the Component Services section and then expand the Computers section.

4.Right-click on My Computer (listed in the Computers section) and select Properties from the pop-up menu.

5.Click the COM Security tab. The My Computer Properties dialog will appear.

6.Click the Edit Default... button in the Access Permissions section. The Access Permission dialog will appear.

7.Under the Group or user names box, click the Add... button.

8.Type Network Service into the box and click OK.

9.Click OK on both the Access Permission and My Computer Properties dialogs to close them.

10.Restart Windows.
This was reported in the SBS Monitoring report. As per T734235, checked the vssadmin list writers on the SBS Server 2008 with no errors. Started the VSS under services.
The "data" portion of this event is similar to the one for event id 8213. ME812877 describes a condition when this may occur. See also the link to Error code 0x8007005.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to



Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.