Hi,

I am tring to restore a Server 2008 R2 Standard Ed (full installation) RTM to a virtual machine, from a full Windows Server Backup image taken of a physical machine (Dell PE 2970).  All restores fine, and looks good until it tries to boot, when a Stop Error occurs, with the following error:

*** STOP: 0x0000007B (0xFFFFF880009A9928, 0xFFFFFFFFC0000034, 0x0000000000000000, 0x0000000000000000)

I believe the non-bracketed portion means "INACCESSABLE_BOOT_DEVICE".

There is only the System Reserved volume + a C: volume (system volume) + F: volume (DVD drive) on the original server.  It has had other volumes in it before, which are correctly listed in the MountedDevices registry key, but they have not been physically present for a while.

The virtual disk I'm trying to restore to is several GBs larger than the original virtual disk on the RAID controller (2 disks in RAID 1).

I can't figure out why the server isn't booting.  I've successfully restored Server 2008 machines from physical machines to VMs before, including servers using hardware RAID cards (e.g. Dell SAS 6/iR).  The only difference I can think of is that this is Server 2008 R2, this is a 2 proc server (I've tried several virtual proc numbers on the VM to no avail), and the RAID controller is PERC 6/i, and this is the first server I've tried with that particular RAID card.

Any help would be greatly appreciated, even if it's to point out that I'm looking in the wrong direction.

Many thanks,

Chris

This is a follow up to things I've written down in an answer to another question:

I'm somewhat sure that `wbengine` of Windows Server 2008 R2 always creates new VHD files if targeting a network share. Here's what some docs and other people say to that topic:

If you save a backup to a remote shared folder, that backup
will be overwritten if you use the same folder to back up
the same computer again.[...]

https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc742130(v=ws.10)

Note that if you are backing up to a network share then a
full backup will be run every time (because VSS is
unavailable) overwriting the previous full backup. In this
case there is no backup policy at all, you are simply
maintaining a remote shadow/copy of the system.

https://lennox-it.uk/a-complete-guide-to-wbadmin-windows-backups

Das kommt darauf an auf welches Medium du sicherst. Wenn auf
Festplatten ect. gesichert wird, dann wird immer inkrementell
gesichert. Wird auf ein Share gesichert, dann ist es immer
ein Vollbackup, wobei das letzte Backup überschrieben wird.

https://administrator.de/forum/verständnisfragen-windows-server-backup-2012-294395.html

Looking at my own tests using Windows 2008 R2, "overwritten" seems to be a bit misleading here, because it seems that really new files get created, as not only names of the images change, but their inodes as well:

root@[...]:~# ls -lisa "/volume1/[...]/WindowsImageBackup/[...]/Backup 2019-11-01 190024"
total 247604492
435         0 drwx------+ 1 [...] users         2582 Nov  2 09:12 .
430         0 drwx------+ 1 [...] users          108 Nov  1 19:58 ..
8200 214832596 -rwx------+ 1 [...] users 220521977856 Nov  1 21:33 3e4779f7-b3e1-11e0-b58f-001999a28c91.vhd
8199  32764536 -rwx------+ 1 [...] users  42484091904 Nov  1 20:12 5d3e4b2f-b386-11e0-ac00-806e6f6e6963.vhd
8214         4 -rwx------+ 1 [...] users         1078 Nov  1 21:33 9506dbe7-82a5-4559-96b3-0a2632ae05f9_AdditionalFilesc3b9f3c7-5e52-4d5e-8b20-19adc95a34c7.xml
8216        12 -rwx------+ 1 [...] users        11940 Nov  1 21:34 9506dbe7-82a5-4559-96b3-0a2632ae05f9_Components.xml
8213         8 -rwx------+ 1 [...] users         5500 Nov  1 21:33 9506dbe7-82a5-4559-96b3-0a2632ae05f9_RegistryExcludes.xml
8203         4 -rwx------+ 1 [...] users         3138 Nov  1 21:33 9506dbe7-82a5-4559-96b3-0a2632ae05f9_Writer0bada1de-01a9-4625-8278-69e735f39dd2.xml
8210         4 -rwx------+ 1 [...] users         1934 Nov  1 21:33 9506dbe7-82a5-4559-96b3-0a2632ae05f9_Writer2a40fd15-dfca-4aa8-a654-1f8c654603f6.xml
8208         4 -rwx------+ 1 [...] users         3414 Nov  1 21:33 9506dbe7-82a5-4559-96b3-0a2632ae05f9_Writer4dc3bdd4-ab48-4d07-adb0-3bee2926fd7f.xml
8207         4 -rwx------+ 1 [...] users         1488 Nov  1 21:33 9506dbe7-82a5-4559-96b3-0a2632ae05f9_Writer542da469-d3e1-473c-9f4f-7847f01fc64f.xml
8212         4 -rwx------+ 1 [...] users         1630 Nov  1 21:33 9506dbe7-82a5-4559-96b3-0a2632ae05f9_Writer59b1f0cf-90ef-465f-9609-6ca8b2938366.xml
8202         4 -rwx------+ 1 [...] users         1628 Nov  1 21:33 9506dbe7-82a5-4559-96b3-0a2632ae05f9_Writer75dfb225-e2e4-4d39-9ac9-ffaff65ddf06.xml
8211         4 -rwx------+ 1 [...] users          950 Nov  1 21:33 9506dbe7-82a5-4559-96b3-0a2632ae05f9_Writera65faa63-5ea8-4ebc-9dbd-a0c4db26912a.xml
8209         4 -rwx------+ 1 [...] users         1484 Nov  1 21:33 9506dbe7-82a5-4559-96b3-0a2632ae05f9_Writera6ad56c2-b509-4e6c-bb19-49d8f43532f0.xml
8206         4 -rwx------+ 1 [...] users         3844 Nov  1 21:33 9506dbe7-82a5-4559-96b3-0a2632ae05f9_Writerafbab4a2-367d-4d15-a586-71dbb18f8485.xml
8205         8 -rwx------+ 1 [...] users         4288 Nov  1 21:33 9506dbe7-82a5-4559-96b3-0a2632ae05f9_Writerbe000cbe-11fe-4426-9c58-531aa6355fc4.xml
8201         4 -rwx------+ 1 [...] users         1746 Nov  1 21:33 9506dbe7-82a5-4559-96b3-0a2632ae05f9_Writerd61d61c8-d73a-4eee-8cdd-f6f9786b7124.xml
8204      7284 -rwx------+ 1 [...] users      7455796 Nov  1 21:33 9506dbe7-82a5-4559-96b3-0a2632ae05f9_Writere8132975-6f93-4464-a53e-1050253ae220.xml
8215         4 -rwx------+ 1 [...] users         1098 Nov  1 21:33 BackupSpecs.xml

root@[...]:~# ls -lisa "/volume1/[...]/WindowsImageBackup/[...]/Backup 2019-11-02 190054"
total 247603788
435         0 drwx------+ 1 [...] users         2582 Nov  2 21:51 .
430         0 drwx------+ 1 [...] users          108 Nov  2 19:59 ..
8247         4 -rwx------+ 1 [...] users         1078 Nov  2 21:51 0d420c40-f14c-4622-85d0-da116fc45608_AdditionalFilesc3b9f3c7-5e52-4d5e-8b20-19adc95a34c7.xml
8249        12 -rwx------+ 1 [...] users        11940 Nov  2 21:51 0d420c40-f14c-4622-85d0-da11
6fc45608_Components.xml
8246         8 -rwx------+ 1 [...] users         5500 Nov  2 21:51 0d420c40-f14c-4622-85d0-da116fc45608_RegistryExcludes.xml
8236         4 -rwx------+ 1 [...] users         3138 Nov  2 21:51 0d420c40-f14c-4622-85d0-da116fc45608_Writer0bada1de-01a9-4625-8278-69e735f39dd2.xml
8242         4 -rwx------+ 1 [...] users         1934 Nov  2 21:51 0d420c40-f14c-4622-85d0-da116fc45608_Writer2a40fd15-dfca-4aa8-a654-1f8c654603f6.xml
8239         4 -rwx------+ 1 [...] users         3414 Nov  2 21:51 0d420c40-f14c-4622-85d0-da116fc45608_Writer4dc3bdd4-ab48-4d07-adb0-3bee2926fd7f.xml
8243         4 -rwx------+ 1 [...] users         1488 Nov  2 21:51 0d420c40-f14c-4622-85d0-da116fc45608_Writer542da469-d3e1-473c-9f4f-7847f01fc64f.xml
8241         4 -rwx------+ 1 [...] users         1630 Nov  2 21:51 0d420c40-f14c-4622-85d0-da116fc45608_Writer59b1f0cf-90ef-465f-9609-6ca8b2938366.xml
8235         4 -rwx------+ 1 [...] users         1628 Nov  2 21:51 0d420c40-f14c-4622-85d0-da116fc45608_Writer75dfb225-e2e4-4d39-9ac9-ffaff65ddf06.xml
8244         4 -rwx------+ 1 [...] users          950 Nov  2 21:51 0d420c40-f14c-4622-85d0-da116fc45608_Writera65faa63-5ea8-4ebc-9dbd-a0c4db26912a.xml
8245         4 -rwx------+ 1 [...] users         1484 Nov  2 21:51 0d420c40-f14c-4622-85d0-da116fc45608_Writera6ad56c2-b509-4e6c-bb19-49d8f43532f0.xml
8240         4 -rwx------+ 1 [...] users         3844 Nov  2 21:51 0d420c40-f14c-4622-85d0-da116fc45608_Writerafbab4a2-367d-4d15-a586-71dbb18f8485.xml
8238         8 -rwx------+ 1 [...] users         4288 Nov  2 21:51 0d420c40-f14c-4622-85d0-da116fc45608_Writerbe000cbe-11fe-4426-9c58-531aa6355fc4.xml
8234         4 -rwx------+ 1 [...] users         1746 Nov  2 21:51 0d420c40-f14c-4622-85d0-da116fc45608_Writerd61d61c8-d73a-4eee-8cdd-f6f9786b7124.xml
8237      7284 -rwx------+ 1 [...] users      7455796 Nov  2 21:51 0d420c40-f14c-4622-85d0-da116fc45608_Writere8132975-6f93-4464-a53e-1050253ae220.xml
8233 214832596 -rwx------+ 1 [...] users 220521977856 Nov  2 21:51 3e4779f7-b3e1-11e0-b58f-001999a28c91.vhd
8232  32763832 -rwx------+ 1 [...] users  42481994240 Nov  2 20:11 5d3e4b2f-b386-11e0-ac00-806e6f6e6963.vhd
8248         4 -rwx------+ 1 [...] users         1098 Nov  2 21:51 BackupSpecs.xml

That is different to what I see on my USB-disks, where images keep their names and file-IDs(/inodes) and only most of the XML files get new UUIDs. On the USB-disks the parent directory of the VHD(X) changes as well, but that is simply a rename and hence doesn't influence the child files in any way. At one point during the tests I managed that `wbengine` decided to keep names of VHD files, but their inode changed always. Didn't invoke with any new command line, though, but simply subsequently:

8260 32767464 -rwx------+ 1 [...] users 42481994240 Nov  3 12:47 5d3e4b2f-b386-11e0-ac00-806e6f6e6963.vhd

8266 32764416 -rwx------+ 1 [...] users 42481994240 Nov  3 13:18 5d3e4b2f-b386-11e0-ac00-806e6f6e6963.vhd

I don't know why they implemented things this way in case of using shares, as it breaks e.g. underlying BTRFS-snapshots. But that's exactly what I see: All the snapshots my NAS creates for the folder where I store those backups almost have all associated storage exclusively instead of sharing large parts of the data. Additionally, according to log file sizes and runtime lengths of `wbengine`, all backups almost take the same amount of time, even though files in the backed up source don't change too much.

So, why did MS choose that implementation of recreating image files?

This is a follow up to things I've written down in an answer to another question:

How does Windows Image Backup decide which files to backup?

Windows/NTFS manages [change journals][2] on each volume, keeping track of which file has changed, how it has changed and because those are part of all NTFS volumes by default, they are available in the VHD(X) of the backup target as well. From my understanding, `wbengine` simply compares those journals to know which files need backup. This makes it easy to support different backup targets without caring about archive bits of files or stuff like that, because those change journals are bound to volume-unique file-IDs and those IDs are exactly the same in the backup target:

C:\>fsutil file queryfileid "C:\Program Files\ActiveState Perl Dev Kit 9.5.1\bin\perlapp.exe"
Datei-ID: 0x000000000000000000080000000ea5f1

C:\>fsutil file queryfileid "D:\Program Files\ActiveState Perl Dev Kit 9.5.1\bin\perlapp.exe"
Datei-ID: 0x000000000000000000080000000ea5f1

In the above example, `C:\` is my current system volume while `D:\` is the mounted last backup on one of the two available backup targets. Even file sizes, timestamps etc. are all the same:

C:\>dir /A "C:\Program Files\ActiveState Perl Dev Kit 9.5.1\bin\perlapp.exe"
 Datenträger in Laufwerk C: ist System
 Volumeseriennummer: 266B-2863

 Verzeichnis von C:\Program Files\ActiveState Perl Dev Kit 9.5.1\bin

03.02.2016  17:08           560.640 perlapp.exe
1 Datei(en),        560.640 Bytes
0 Verzeichnis(se), 1.337.040.216.064 Bytes frei

C:\>dir /A "D:\Program Files\ActiveState Perl Dev Kit 9.5.1\bin\perlapp.exe"
 Datenträger in Laufwerk D: ist System
 Volumeseriennummer: 266B-2863

 Verzeichnis von D:\Program Files\ActiveState Perl Dev Kit 9.5.1\bin

03.02.2016  17:08           560.640 perlapp.exe
1 Datei(en),        560.640 Bytes
0 Verzeichnis(se), 1.281.302.233.088 Bytes frei

By using this approach, backup can decide at any time with any older VHD(X) which files need to be backed up, as long as the current journal and the one in the image have something in common, which are entry-IDs in my understanding. Without such a shared ID, e.g. because too many I/O happend productive and the backup is too old, wbengine would simply do a full backup instead of an incremental one.

Using those journals makes it as well pretty fast to know which files to backup, because one doesn't need to iterate the whole tree of files. That's what one actually sees in practice as well: Backup seems to know pretty soon which files to backup and starts processing those instead of iterating a file tree.

Behaviour in case of network shares as backup target for Windows Server 2012+.

In older versions of Windows, wbengineseems to have always recreated VHD files, making it pretty incompatible with snapshots supported by some underlying file system like BTRFS or ZFS. Additionally, each and every backup was a full one, simply because wbengine didn't have access to any former backup to compare with.

Things seem to be a little bit different with newer versions of Windows: I'm somewhat sure that one customer of mine ran into troubles with wbadmin and Windows Server 2012 and during debugging those using Process Monitor, I verified that existing VHDX files were kept instead of deleted and recreated. I've tested this right now with Windows Server 2019 again and multiple invocations ofwbadmin led to successful backups while KEEPING inodes of VHDX files the same:

root@[...]:~# ls -lisa "/volume1/[...]/Backup 2019-11-02 200024"
total 549063256
 271         0 d---------+ 1 user group          594 Nov  2 20:58 .
 266         0 d---------+ 1 user group          108 Nov  2 20:58 ..
 273 507813736 ----------+ 1 user group 520061190144 Nov  2 22:02 165c4b13-8376-4c55-9643-a8c1b2c17d6b.vhdx
3814         4 ----------+ 1 user group          776 Nov  1 22:47 52e1a857-4620-43af-9f6e-a03fb53c7c30_AdditionalFilesc3b9f3c7-5e52-4d5e-8b20-19adc95a34c7.xml
3816       440 ----------+ 1 user group       450488 Nov  1 22:47 52e1a857-4620-43af-9f6e-a03fb53c7c30_Components.xml
3813         8 ----------+ 1 user group         6212 Nov  1 22:47 52e1a857-4620-43af-9f6e-a03fb53c7c30_RegistryExcludes.xml
3815         4 ----------+ 1 user group         1192 Nov  1 22:47 BackupSpecs.xml
 272  41249064 ----------+ 1 user group  42289070080 Nov  2 22:03 f7650533-11ca-4db4-80f5-2db42f7b900a.vhdx

root@[...]:~# ls -lisa "/volume1/[...]/Backup 2019-11-03 132201"
total 549318872
 271         0 d---------+ 1 user group          594 Nov  2 20:58 .
 266         0 d---------+ 1 user group          108 Nov  3 14:19 ..
 273 507813736 ----------+ 1 user group 520061190144 Nov  3 14:19 165c4b13-8376-4c55-9643-a8c1b2c17d6b.vhdx
3814         4 ----------+ 1 user group          776 Nov  1 22:47 52e1a857-4620-43af-9f6e-a03fb53c7c30_AdditionalFilesc3b9f3c7-5e52-4d5e-8b20-19adc95a34c7.xml
3816       440 ----------+ 1 user group       450488 Nov  1 22:47 52e1a857-4620-43af-9f6e-a03fb53c7c30_Components.xml
3813         8 ----------+ 1 user group         6212 Nov  1 22:47 52e1a857-4620-43af-9f6e-a03fb53c7c30_RegistryExcludes.xml
3815         4 ----------+ 1 user group         1192 Nov  1 22:47 BackupSpecs.xml
 272  41504680 ----------+ 1 user group  42289070080 Nov  3 14:21 f7650533-11ca-4db4-80f5-2db42f7b900a.vhdx

root@[...]:~# ls -lisa "/volume1/[...]/Backup 2019-11-03 133308"
total 41262660
 271        0 d---------+ 1 user group        2504 Nov  3 14:44 .
 266        0 d---------+ 1 user group         108 Nov  3 14:30 ..
3851        4 ----------+ 1 user group         776 Nov  3 14:44 22c1a052-3d01-438c-87f8-acf63f14f5b5_AdditionalFilesc3b9f3c7-5e52-4d5e-8b20-19adc95a34c7.xml
3853      440 ----------+ 1 user group      450488 Nov  3 14:44 22c1a052-3d01-438c-87f8-acf63f14f5b5_Components.xml
3850        8 ----------+ 1 user group        6212 Nov  3 14:44 22c1a052-3d01-438c-87f8-acf63f14f5b5_RegistryExcludes.xml
3840        4 ----------+ 1 user group        3138 Nov  3 14:44 22c1a052-3d01-438c-87f8-acf63f14f5b5_Writer0bada1de-01a9-4625-8278-69e735f39dd2.xml
3848        4 ----------+ 1 user group        2284 Nov  3 14:44 22c1a052-3d01-438c-87f8-acf63f14f5b5_Writer2707761b-2324-473d-88eb-eb007a359533.xml
3844        8 ----------+ 1 user group        5386 Nov  3 14:44 22c1a052-3d01-438c-87f8-acf63f14f5b5_Writer4dc3bdd4-ab48-4d07-adb0-3bee2926fd7f.xml
3846        4 ----------+ 1 user group        1488 Nov  3 14:44 22c1a052-3d01-438c-87f8-acf63f14f5b5_Writer542da469-d3e1-473c-9f4f-7847f01fc64f.xml
3839        4 ----------+ 1 user group        1628 Nov  3 14:44 22c1a052-3d01-438c-87f8-acf63f14f5b5_Writer75dfb225-e2e4-4d39-9ac9-ffaff65ddf06.xml
3842       24 ----------+ 1 user group       21686 Nov  3 14:44 22c1a052-3d01-438c-87f8-acf63f14f5b5_Writera65faa63-5ea8-4ebc-9dbd-a0c4db26912a.xml
3847        4 ----------+ 1 user group        1484 Nov  3 14:44 22c1a052-3d01-438c-87f8-acf63f14f5b5_Writera6ad56c2-b509-4e6c-bb19-49d8f43532f0.xml
3845        4 ----------+ 1 user group        2940 Nov  3 14:44 22c1a052-3d01-438c-87f8-acf63f14f5b5_Writerafbab4a2-367d-4d15-a586-71dbb18f8485.xml
3849        4 ----------+ 1 user group        1850 Nov  3 14:44 22c1a052-3d01-438c-87f8-acf63f14f5b5_Writerb2014c9e-8711-4c5c-a5a9-3cf384484757.xml
3843        8 ----------+ 1 user group        6048 Nov  3 14:44 22c1a052-3d01-438c-87f8-acf63f14f5b5_Writerbe000cbe-11fe-4426-9c58-531aa6355fc4.xml
3838        4 ----------+ 1 user group        1746 Nov  3 14:44 22c1a052-3d01-438c-87f8-acf63f14f5b5_Writerd61d61c8-d73a-4eee-8cdd-f6f9786b7124.xml
3841    13068 ----------+ 1 user group    13379228 Nov  3 14:44 22c1a052-3d01-438c-87f8-acf63f14f5b5_Writere8132975-6f93-4464-a53e-1050253ae220.xml
3852        4 ----------+ 1 user group         758 Nov  3 14:44 BackupSpecs.xml
 272 41249064 ----------+ 1 user group 42289070080 Nov  3 14:44 f7650533-11ca-4db4-80f5-2db42f7b900a.vhdx

So in theory this should allow incremental backups replacing files in-place and efficient snapshots of e.g. underlying BTRFS or ZFS at the same time. Looking at storage of the snapshots of the tested Windows Server 2019, at least some of those really share some space:

    Total   Exclusive  Set shared  Filename
424.41GiB   417.69GiB     6.72GiB  /volume1/@sharesnap/[...]/GMT+01-2019.10.29-00.00.09
446.53GiB   400.16GiB    46.37GiB  /volume1/@sharesnap/[...]/GMT+01-2019.10.30-00.00.08
483.05GiB   448.36GiB    34.70GiB  /volume1/@sharesnap/[...]/GMT+01-2019.10.31-00.00.08
553.78GiB   209.26GiB   344.52GiB  /volume1/@sharesnap/[...]/GMT+01-2019.11.02-00.00.09
204.68GiB   204.63GiB     0.05GiB  /volume1/@sharesnap/[...]/GMT+02-2019.10.01-00.00.07
410.24GiB   405.37GiB     4.87GiB  /volume1/@sharesnap/[...]/GMT+02-2019.10.27-00.00.06

It's not as much as I would expect, though. The thing is that it might be that not much space is shared even though VHDX files are reused, because when I subsequently invoke backing up C:\ of that server, backup doesn't seem to get faster.

The first backup might take longer as much data has changed, but after that is finished and with the server doing nothing, a second backup only a few minutes later should be a lot faster, because of only backing up differences of the files. But that doesn't seem to be the case, instead it seems to take the same time like before. Additionally, while BTRFS can share differences in created snapshots between different invocations of wbadmin with the exact same command line, those are much smaller than expected when really only backing up changed files:

root@[...]:~# btrfs filesystem du -s --gbytes /volume1/@sharesnap/[a-zA-Z]*/GMT*
     Total   Exclusive  Set shared  Filename
446.53GiB   400.20GiB    46.33GiB  /volume1/@sharesnap/[...]/GMT+01-2019.10.30-00.00.08
483.05GiB   448.36GiB    34.70GiB  /volume1/@sharesnap/[...]/GMT+01-2019.10.31-00.00.08
553.78GiB   546.54GiB     7.24GiB  /volume1/@sharesnap/[...]/GMT+01-2019.11.02-00.00.09
  39.35GiB    37.68GiB     1.67GiB  /volume1/@sharesnap/[...]/GMT+01-2019.11.03-15.36.52
  39.35GiB    31.18GiB     8.17GiB  /volume1/@sharesnap/[...]/GMT+01-2019.11.03-15.49.03
  39.35GiB    37.98GiB     1.37GiB  /volume1/@sharesnap/[...]/GMT+01-2019.11.03-16.03.06
410.24GiB   409.72GiB     0.52GiB  /volume1/@sharesnap/[...]/GMT+02-2019.10.27-00.00.06

That is different to what I see when backing up to my USB-disks, subsequent backups are much faster if nothing has changed. What is interesting is that others seem to be not so sure about how things behave on network shares as well:

If you create a scheduled backup job to network shared folder or a mapped network drive, 
all the backups will only be performed by full backup because network location is not a volume. 
If you need to create differential backup or incremental backup to network folder,
you need to third party backup software.

https://www.ubackup.com/windows-server/windows-server-backup-differential-4348.html

While the same people write the following, which doesn't make much sense:

Tip: You can also use WBADMIN to create incremental backup to network share, like this:
wbadmin start backup –backupTarget: \\backupshare\backup1 -allCritical -include:C: -vssFull –quiet

https://www.ubackup.com/articles/wbadmin-incremental-backup-5740.html

In case of backing up to shares, if VHD is recreated always, like seems to be the case for older versions of Windows, one doesn't get incremental backups. But even though VHDX files are kept in newer versions of Windows, it seems like only backing up changed files still doesn't work the same way like it does when using USB-disks.

Using -vssFull vs. -vssCopy didn't make any difference in my tests and according to my understanding is not even intended to do so. Those arguments are only relevant to 3rd party software and don't influence which files are backed up how. Reasons to believe so are documented in my former answer:

Influence of -vssFull and -vssCopy.

https://serverfault.com/a/990394/333397

Questions

Does `wbengine` of Windows Server 2019 support incremental backups when targeting network shares? Does anyone see any improvement in backup times and storage allocations in case of snapshots?

Hi guys, 

I have two failover clusters with three nodes (based on Windows Server 2019) in each cluster. 

Virtual machines are protected by means of Altaro Backup. 

After continuous period of warnings generated by Altaro Backup it has been found in both Windows System log and Altaro backup log that some volume (which obviously Altaro backup refers to) MFT contains corrupted file record.

A corruption was discovered in the file system structure on volume \\?\Volume{8a4d749a-3081-4ba5-a001-c70bb335c2de}.

The Master File Table (MFT) contains a corrupted file record.  The file reference number is 0x1000000029104.  The name of the file is "<unable to determine file name>".

2019-11-05 02:39:30.037 0059 BackupMilestoneProvider.ScanEventLog    : Suspicious record: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Ntfs' Guid='{dd70bc80-ef44-421b-8ac3-cd31da613a4e}'/><EventID>55</EventID><Version>0</Version><Level>2</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2019-11-04T13:41:03.583214500Z'/><EventRecordID>491689</EventRecordID><Correlation/><Execution ProcessID='4' ThreadID='25808'/><Channel>System</Channel><Computer>hvhost01.company.com</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='DriveName'>\\?\Volume{8a4d749a-3081-4ba5-a001-c70bb335c2de}</Data><Data Name='DeviceName'>\Device\HarddiskVolume9415</Data><Data Name='CorruptionState'>0x0</Data><Data Name='HeaderFlags'>0x922</Data><Data Name='Severity'>Critical</Data><Data Name='Origin'>File System Driver</Data><Data Name='Verb'>Bad FRS</Data><Data Name='Description'>The Master File Table (MFT) contains a corrupted file record.  The file reference number is 0x1000000029104.  The name of the file is "&lt;unable to determine file name&gt;".
</Data><Data Name='Signature'>0x504df163</Data><Data Name='Outcome'>Read Only Volume</Data><Data Name='SampleLength'>0</Data><Data Name='SampleData'></Data><Data Name='SourceFile'>0x1</Data><Data Name='SourceLine'>1250</Data><Data Name='SourceTag'>203</Data><Data Name='AdditionalInfo'>0xd00000a2</Data><Data Name='CallStack'>Ntfs+0x11e86, Ntfs+0x1710f4, Ntfs+0x15374f, Ntfs+0x15fec1, Ntfs+0xf3d56, Ntfs+0x19a5e, ntoskrnl+0x5d11a, ntoskrnl+0x1216c5, ntoskrnl+0x1b849c</Data></EventData></Event>
2019-11-05 02:39:30.037 0059 BackupMilestoneProvider.ScanEventLog    : Suspicious record: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Ntfs' Guid='{dd70bc80-ef44-421b-8ac3-cd31da613a4e}'/><EventID>55</EventID><Version>0</Version><Level>2</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2019-11-04T13:41:16.366578900Z'/><EventRecordID>491714</EventRecordID><Correlation/><Execution ProcessID='4' ThreadID='26308'/><Channel>System</Channel><Computer>hvhost01.company.com</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='DriveName'>\\?\Volume{8a4d749a-3081-4ba5-a001-c70bb335c2de}</Data><Data Name='DeviceName'>\Device\HarddiskVolume9420</Data><Data Name='CorruptionState'>0x0</Data><Data Name='HeaderFlags'>0x922</Data><Data Name='Severity'>Critical</Data><Data Name='Origin'>File System Driver</Data><Data Name='Verb'>Bad FRS</Data><Data Name='Description'>The Master File Table (MFT) contains a corrupted file record.  The file reference number is 0x1000000029104.  The name of the file is "&lt;unable to determine file name&gt;".

I went through the thread below:

https://social.technet.microsoft.com/Forums/ie/en-US/510db7df-35cf-4e20-a1fd-23bdb934712c/event-55-ntfs-the-file-system-structure-on-the-disk-is-corrupt-and-unusable?forum=winservergen

https://social.technet.microsoft.com/Forums/windowsserver/en-US/5cbed1b1-63e3-4c15-8fff-b48746d5ba44/2008r2-backup-causing-event-55-ntfs-errors?forum=windowsbackup

Found no shadow copies. Also, not sure if chkdsk would shed some light if I run it. 

Is there anything else worth to try?

Dear Team,

Please help us to fix the below issue

VSS: Backup job failed. Cannot notify writers about the ''BACKUP FINISH'' event. A VSS critical writer has failed. Writer name: [Microsoft Exchange Writer]. Class ID: [{76fe1ac4-15f7-4bcd-987e-8e1acb462fb7}]. Instance ID: [{b9c55704-4b55-4a1f-886e-0922334a6199}]. Writer''s state: [VSS_WS_FAILED_AT_BACKUP_COMPLETE]. Error code: [0x800423f3].

Regards

Aghil

Hi all, need your kind help.

OS is Windows Server 2012 R2 Standard  6.3.9600 Build 9600, after online windows update, the windows server backup function cannot work.

• When open window backup UI, got error message as below:

   There are too few disks on this computer or one or more of the disks is too small...

• When using wbadmin command, got error message as below:

   A fatal error occured during a Windows Server Backup snap-in(Wbadmin.msc) operation...

Aready tried below but still not work.

  Remove/backup the log files: C:\Windows\Logs\WindowsServerBackup
  Uninstall the feature: “windows backup server”
  Restart the Server
  Restart again for good measure
  Install the feature: “windows backup server”

Hi there,

I am currently using robocopy to backup our satellite office file server across WAN to our main location. It works OK for the most part until it gets to pst files.

If pst files are changed (which they are on a daily basis), robocopy backs up the whole file instead of the changed parts. The problem is that these PST files are big (over 2gb in size) and the WAN connection isn't great.

Can anyone suggest perhaps another solution that backs only the changed parts INSIDE the pst files instead of the whole file. As far as i understand robocopy does not have that capability. Perhaps this is relevant to other file extensions also, not just PST.

Any help would be greatly appreciated.

Thanks,

Event ID 517, No Antivirus, If old WindowsImageBackup folder delete or rename then schedule backup working properly otherwise given below error.

The backup operation that started at '‎2019‎-‎10‎-‎17T07:08:00.337786100Z' has failed with following error code '0x80070020' (The process cannot access the file because it is being used by another process.). Please review the event details for a solution, and then rerun the backup operation once the issue is resolved.

Md. Ramin Hossain

Nikorios

Typically, When Windows server backup drive is formatted, it is formatted in such a way where it is hidden from explorer (and subsequently ransomware) but can be seen in Drive Management.

This has been the behavior of all the systems I use MS server backup on which are many.

However, I have one problem child windows server 2008 std system that doggedly applies Z: drive letter to the usb backup drive.

Can I turn this off? I have two drives I swap in daily and while I can remove the drive letter it is reapplied as soon as I plug the other drive in.

Hi,

In one of the Server 2008 SP2 system writer is missing. I have below troubleshoots but still issue is there.

1) Restarted the "Cryptographic services"

2) Registered the DLL files

3) Rebooted the server.

4) Applied access to the files in %windir%\winsxs\filemaps\

Can anyone suggest what needs to checked to fix the issue.

Thanks in advance.

vicky

I'm backing up some Windows Server 2019 using wbadmin to some Synology-NAS using SMB. Once in a while the logs created during those backups mention that one of the created VHDX files gets compressed/compacted. The server is using German language for these logs and those use a term which means "compressing" actually, so not sure which of both is really done, but I strongly guess it means "compacting".

Looking at the logs, that process is pretty fast for C:\ most likely, which only contains Windows itself and some installed applications. Most of the data is stored on D:\ instead and that data contains some databases, plain files available using network shares, a VM and stuff like that. So there's quite some amount of I/O on that volume.

Looking at the logs of the last time that was done for D:\, I recognized two interesting things: 1. that process took around an hour to succeed and 2. the logs start at 30 % and stopped at 69 %. I know that it took around an hour because without compressing/compacting the backup finishes mostly around 22:45 o'clock.

Von Volume "Daten(D:)" wird eine Sicherung erstellt. Kopiert: (100%).
Die virtuelle Festplatte für das Volume "Daten(D:)" wird komprimiert. Abgeschlossen: (30 %).
[...]
Die virtuelle Festplatte für das Volume "Daten(D:)" wird komprimiert. Abgeschlossen: (69 %).

Ende Datensicherung 13.11.2019 23:59:36,66

So what happens during that process, especially in case of storing to SMB?

From my understanding, one needs to first know which blocks of the VHDX are not used anymore. Because there's NTFS inside that image, I guess Windows simply knows that and doesn't need to scan the file in some expensive process? After knowing which blocks are not needed anymore, those can be freed to actually reduce the storage needed for the VHDX. If it would sit on NTFS itself, I guess this would be done by unallocating blocks from some sparse file or would it really write 0s to the not needed blocks? However, the VHDX is accessed using SMB with BTRFS underneath, so most likely doesn't know about any spare file. So it might move blocks from the end of the file to allocated, but free blocks and simply trims the file afterwards?

If large amounts of data really need to be copied, that would explain why the process takes pretty long and why 30 and 69 % are logged only, that being the copied range of data inside the VHDX maybe or even only copying the data itself and other operations before and after 30 and 69 % are pretty fast again.

Hi IT Experts,

1.  Past few days our domain users (not specific user) complaining about their account locked out if the system is idle for few mins. I verified all the GPO's but there is no such GPO created except "Account Lock Out" if more than 5 times wrong password, so was manually unlock the account and advising users to spell check before entering the password, surprisingly yesterday it happens to one of our IT Security Admin user who is already into Administrator group.  It was more surprise to us while working on the system tried to connect to the one of the server via RDP using the same logged in account and received the error saying account is locked. 

Now, I'm sure that our users may not be entering the wrong password but it is getting locked for unknown reason.  Kindly advice what could be the reason and solution? 

2.  As staked above, I have enabled Block Inherit Policy to the IT security Group / OU but still the account lock out policy affect and getting locked, pls. advice what additional steps to configure 

Thanks in advance.

  I have a customer with two Windows 2008 R2 Hyper-V host servers running a wbadmin (Windows Backup).  The one server backs up just fine.  However, the other server consistently fails with the following error:

Detailed error: ERROR - The shared restore point operation failed with error (0x81000101) The creation of a shadow copy has timed out. Try this operation again.

   In the Event Viewer (Application log), I see the following error:

The backup operation that started at '‎2011‎-‎04‎-‎27T06:15:23.955000000Z' has failed because the Volume Shadow Copy Service operation to create a shadow copy of the volumes being backed up failed with following error code '2155348001'. Please review the event details for a solution, and then rerun the backup operation once the issue is resolved.

   However I can't find any further error messages (in either the guest VM's event viewer or in the Hyper-V host's event viewer).  

   A few additional notes:

• Server has SP1 installed.  The problem with the backup predates the SP1 installation.
• Reboots don't fix the backup problem.
• After a failed backup, both the Hyper-V VSS writer and the System Writer have the following state in "vssadmin list writers": State: [5] Waiting for completion 
• I can't do a manual volume or file/folder backup of the drive which has VM's on it using wbadmin because the Volume Shadow fails.
• A "DELETE SHADOWS ALL" from DISKSHADOW didn't fix the problem.
• I was wondering if the problem was due to KB982210  (http://garysgambit.blogspot.com/2010/05/windows-2008-hyper-v-vss-backup-bug.html and http://support.microsoft.com/kb/982210).  The HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\STORAGE\Volume on this system does have a a lot of entries, and the initial logon to the host after a reboot does take a while.  But my Vhdmp.sys has a newer version than this hotfix so I'm assuming that the SP1 for Windows 2008 R2 replaced this file and my guess is that this hotfix won't work on Windows 2008 R2 SP1 servers.  

   Anyone with any good ideas?  [At this point I may even accept bad ones...]

Thanks! dbaddorf

Hi everyone,

I'm using Windows Server Backup on a Windows Server 2012 R2 system that has been in production for half a year or so.  The server has around 60GB used, and the backup drive is a 160GB external drive that I had sitting around and put it in place until they can afford a larger external drive.  The setup has been working great, and just yesterday when I opened the Windows Server Backup utility, I noticed that all backups have been successful and there were well over 100 backups available.  The external hard drive was showing "in the red" for space available, about 15GB free or so if I remember right.  But that's fine, since I understand that Windows Server Backup should delete the oldest backup available.

...OR...you know, it deletes everything.  So I log in today, and what do you know?  60ish GB used on the external drive, so plenty of free space.  But only 1 copy available.  Is...like...am I missing something?  Is that how it's supposed to work when the drive gets full?  I was under the impression it would delete files from the oldest snapshot and create a new backup.  Or delete several old snapshots.

Did something happen in a recent Windows update?  Any way to fix it?  In my little bit of searching before this, I found that some others have had experiences with at least Server 2008 where Windows Server Backup would all the sudden only keep 1 copy.  So I guess I'll know tomorrow whether or not that's happening to me; whether I see "1 copy available" again, or "2 copies available".

Thanks in advance for any advice!

Hi all,

i have a fujitsu rx1330 server with Windows Server 2019 installed. The 2 gbit ports are connected to a switch. Network connection generally runs without any issues.

At 3:00 a.m i run a complete windows backup, with  all hdd's, all hyper-v VMs, baremetal.... to a iscsi mounted network drive.

For this Backup iam using the onboard windwos backup tool.

Within this backup i got every day a short network connection loss, that is a problem because one of the hyper-v VMs needs a permanent network connection 7x24.

I already updated the intel network adapter drivers to the newest version from July 2019 and VMQ i disabled.

Do you have any solution for this issue?

I wont use another commercial backup software for which i have to pay for it.

BR

I am getting an error from Backup Exec when trying to backup one of my Windows 2008 R2 Servers that indicates that I need to rebuild the usn change journal database. I looked up the commands for accomplishing this and just had a couple of questions about executing these. First: Are these the right sequence of commands to run? -->

fsutil usn deletejournal /d c:
fsutil usn createjournal m=1000 a=100 c:

Second: I am assuming the best time to run these would be right before a full backup?

So this is strange issue that started occurring about a month ago, and I have been unable to find any useful resources online. This may or may not be related, but this started happening very soon after we migrate our VM disks to a new datastore on a new storage device in vmware. I have managed to get at least one successful backup weekly, but this is after many failed attempts with the same errors.

I originally thought this was a Backup Exec issue but after spending hours on the phone with them they declared that this is a Microsoft issue since the same problem occurred using Windows Server Backup as well.

Here are the errors occurring. This typically happens during the System State Backup or during the C: drive backup.

Source: VSS Event ID: 8193 Level: Error Logged: 9/20/2017 9:25:20 AM

Volume Shadow Copy Service error: Unexpected error calling routine IMultiInterfaceEventControl::GetSubscriptions.  hr = 0x80010108, The object invoked has disconnected from its clients.
.

Source: VSS Event ID: 12291 Level: Error Logged: 9/20/2017 9:25:20 AM

Volume Shadow Copy Service error: Error on creating/using the COM+ Writers publisher interface: BackupShutdown [0x80042302, A Volume Shadow Copy Service component encountered an unexpected error.
Check the Application event log for more information.
]. 

Source: VSS Event ID: 8193 Level: Error Logged: 9/20/2017 9:50:08 AM

Volume Shadow Copy Service error: Unexpected error calling routine IVssAsync::QueryStatus.  hr = 0x800706ba, The RPC server is unavailable.
. 

Operation:
   BackupComplete Event
   Executing Asynchronous Operation

Context:
   Current State: BackupComplete

Source: Backup Event ID: 517 Level: Error User: System

The backup operation that started at '‎2017‎-‎09‎-‎20T13:04:54.929785700Z' has failed with following error code '0x807800AF' (The Volume Shadow Copy Service backup complete operation failed. See the event logs for more details.). Please review the event details for a solution, and then rerun the backup operation once the issue is resolved.

Has anyone ever seen or encountered these problems before? They are making backup up our server almost impossible. Any suggestions would be greatly appreciated.

Thank you!

Hello,

How can we make sure the Azure VM Application consistent backup . We have few windows and Linux VMs with databases and we want to take application consistent backup to avoid any data corruption during backup/restore.

Is it possible ?

suhag

Hello,

When I try to run a system state backup with this command: wbadmin start systemstatebackup -backuptarget:<drive letter>

I get the error

"Failed to create the shared protection point on the source volumes.

ERROR - Volume Shadow Copy Service operation error (0x8004230f)
The shadow copy provider had an unexpected error while trying to process the specified operation."

I'm not sure how to fix this. I'm logged into the machine as an Administrator.

Windows Server Enterprise 2008 SP2 64-bit

Any suggestions??