Backups complete with the exception: "VSS snapshot warning. File [PATH] [FILENAME] is not present on the snapshot."

One of the below mentioned workarounds can also be used to resolve the issue:

 

 

Note: The Backup Exec Console Job Monitor may report the final job status as "Successful".  The job is marked as successful because the exceptions are not critical enough to prevent a successful restore.

Other Resolutions: As there are potentially an infinite number of applications installers that could cause problems of this nature, Veritas cannot document them all.   The following are examples of just some of the specific files that have been reported to Veritas. If the steps below do not resolve the issue, please contact the software vender for further assistance. Click on one of the file names mentioned below to get help on resolving the issue:

 

 

IAS.XML	SLANACCEL.EXE	NTMSDATA.BAK	DCDBASE64.SYS
DCDBASE32.SYS	SMCINST.EXE	BOOTMGR	VMNETDHCP.EXE
ASPNET_STATE.EXE	SmcLU\SETUP.EXE	OEM16.INF	BRSCV01A.EXE
S3CAP.SYS	STORFLT.SYS	HPSUMSERVERW32.EXE	OEM12.INF
LSI_SAS.SYS	SAPOSCOL.EXE	SMCINST.EXE	CCSVCHST.EXE
OEM6.INF	04MMDAT.SYS

1. Delete the SAN/LAN Transfer Virtual Accelerator service ( this will not impact the system as the executable for the same i.e. slanaccel.exe is already removed).

2. To delete the SAN/LAN Transfer Virtual Accelerator service:

•   Logon as the Administrator on HOST.

•   Type the following command:

1. Either stop and disable the Removable storage service from the Windows Services console 

OR

1. Modify the backup selection list and deselect the "Removable Storage Manager" listed under Shadow Copy Components - Service State of the effected system. (See figure below)

1. Download and install the latest drivers from Dell.
2. Copy an earlier version of the dcdbase driver (earlier than 5.7) from another server with the same operating system and patch level to the path specified in the exception.
    

Problem 2:
VSS reports the file, smcinst.exe as a file needed to restore the services for the System State, but it does not actually check to see if the file exists, hence the error when Backup Exec attempts to back up the file.

Solution 2:

1. Search for the file name in the registry, determine why the file is missing.

Example: 
       Was the software uninstalled, but a registry key remains?
       Was the file deleted accidentally and the application needs to be repaired?

2. Once the straggling registry entry is either removed or repaired and the missing files are restored, the backup warnings should stop.

 BOOTMGR

Error:
File %BeBootDrive%\bootmgr is not present on the snapshot.
Example of error from the Remote Agent debug log on service start:

[2444] Initializing FSs
[2444] Unable to process entry %BeBootDrive%\bootmgr, this means restore will have issues

Example of error in the Remote Agent debug log during a backup job:

[4108] AD:Trouble moving to ROOT path - Status ????? (0x2000FE07) in SystemState::AddPathToSnapshotSet:615
[4108] AD:Trouble adding "System?State\Active Directory" to set - Status FS_NO_MORE (0x2000FE07) in SystemState::AddToSnapshotSet:495
[4108] Writer Automated System Recovery include file list:
[4108] Writer Automated System Recovery exclude file list
[4108] WriterID {BE000CBE-11FE-4426-9C58-531AA6355FC4} InstanceID {9EB918D9-CFC4-4036-9154-259E516D7DD7} selected for backup or restore.
[4108] ImagePath does not has a valid File path
[4108] Status INVALID_PATH_DESCRIPTOR (0xE000FE21) processing file path \\?\GLOBALROOT\Device\HarddiskVolume1\EFI\Microsoft\Boot when getting file descriptors
[4108] Unable to process entry %BeBootDrive%, this means this file will have issues
[4108] Component BCD file list:
[4108] o: %BeBootDrive%\bootmgr

Cause:
A System that utilizes uEFI may receive the exception above when the System State is backed up.

Solution:

1. Exclude the ASR writer from the list of approved writers; ASR writer id is ‘{BE000CBE-11FE-4426-9C58-531AA6355FC4}'.

To exclude the ASR Writer follow the steps below:
a. Open the Registry on the machine being protected.

Warning: Incorrect use of the Windows registry editor may prevent the operating system from functioning properly. Great care should be taken when making changes to a Windows registry. Registry modifications should only be carried-out by persons experienced in the use of the registry editor application. It is recommended that a complete backup of the registry and workstation be made prior to making any registry changes.

b. Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\Backup Exec for Windows\Backup Exec \Engine\Shadow Copy Components\
c. Right click Shadow Copy Components and create a new Key as Additional Not Authorized Writers.
d. Select or Highlight Additional Not Authorized Writers key, and create a String value named ASR.
e. Double click the created String Value ASR, add the value of ASR Writer id '{BE000CBE-11FE-4426-9C58-531AA6355FC4}'.
f. Close the Registry,reboot the server

Note: This will ignore the ASR Writer from the approved Writer list.

2. Run the System State backup.

All backups that have the System State selected and have uEFI will need to have the job recreated or System State removed from the job manually and re-selected.

VMNETDHCP.EXE

Error:
File c:\windows\system32\vmnetdhcp.exe is not present on the snapshot.

Cause:
The warnings above may appear in backup jobs if the paths for the "VMware NAT Service" and "VMware DHCP Service" services are not listed correctly in the registry. The System Information utility can be used to confirm where the modules are loading from as well as the location specified by the service:
 

1. Go to Start > Run. Type MSINFO32 and then click OK. This will open the System Information utility.
2. Expand "Software Environment" and select "Loaded Modules"
3. In the list of loaded modules find vmnat.exe and vmnetdhcp.exe. Look at the Path column to see from which directory these modules are loading.

Example:
c:\windows\syswow64\vmnat.exe
c:\windows\syswow64\vmnetdhcp.exe

4. Under "Software Environment" select "Services". Locate the services "VMware NAT Service" and "VMware DHCP Service". Check the Path column. This value should be the same path as what was seen in "Loaded Modules". However, the Backup Exec warning will occur if the path here is different.

Example:

c:\windows\system32\vmnetdhcp.exe
c:\windows\system32\vmnat.exe

This issue is caused If the path found in "Loaded Modules" is different than the path found in "Services"

Solution: 
To correct this, the paths for the services can be corrected in the Windows registry:
 
Warning: Incorrect use of the Windows registry editor may prevent the operating system from functioning properly. Great care should be taken when making changes to a Windows registry. Registry modifications should only be carried-out by persons experienced in the use of the registry editor application. It is recommended that a complete backup of the registry and workstation be made prior to making any registry changes.
 

1. Go to Start > Run. Type SERVICES.MSC and click OK
2. Stop the services "VMware NAT Service" and "VMware DHCP Service"
3. Go to Start > Run. Type REGEDIT and click OK
4. Browse to: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VMware NAT Service\

 Edit the ImagePath value to read the correct path found in the "Loaded Modules" section of the System Information.
Example: c:\windows\syswow64\vmnat.exe

5.  Browse to: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VMnetDHCP\

Edit the ImagePath value to read the correct path found in the "Loaded Modules" section of the System Information.
Example: c:\windows\syswow64\vmnetdhcp.exe
 

6. Start the services "VMware NAT Service" and "VMware DHCP Service"

ASPNET_STATE.EXE

Error:
c:\windows\microsoft.net\framework\v2.0.50727\aspnet_state.exe

Cause:
If an application which has a dependency on Microsoft .Net Framework 2.0 is installed on the Windows 2008 (x64) it will install the aspnet_state.exe under C:\windows\framework\v2.0.50727.
For a 64 bit installation of Windows 2008, the installation path for Microsoft .Net Framework 2.0 is c:\windows\microsoft.net\framework64\v2.0.50727. When backup of System state is performed, it looks for the aspnet_state.exe under c:\windows\microsoft.net\framework64\v2.0.50727

Solution:

1. On the Windows 2008 (x64) server, open up the registry editor by going to Start > Run > Regedit.
2. Change the following registry keys to point the Image path to the correct location so that it gets backed up as part of the System State.

Warning: Incorrect use of the Windows registry editor may prevent the operating system from functioning properly. Great care should be taken when making changes to a Windows registry. Registry modifications should only be carried-out by persons experienced in the use of the registry editor application. It is recommended that a complete backup of the registry and workstation be made prior to making any registry changes.

Browse to the following registry paths:

• HKLM\SYSTEM\CurrentControlSet\Services\aspnet_state
• HKLM\SYSTEM\ControlSet001\Services\aspnet_state
• HKLM\SYSTEM\ControlSet003\Services\aspnet_state

The Key named ImagePath which is an Expandable String Value(REG_EXPAND_SZ) needs to be modified from
%SystemRoot%\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe to the following:
%SystemRoot%\Microsoft.NET\Framework64\v2.0.50727\aspnet_state.exe

3. Exit the Windows registry editor.
4. Run a backup of System State of the machine on which the above registry changes were made and it will be successful.

SmcLU\Setup.exe

Error:
C:\Program Files\Symantec\Symantec Endpoint Protection\SmcLU\setup.exe

Cause:
SEPM downloads and places the upgrades temporarily at this location. As soon as the installation of the updates is complete SEPM deletes the temporary files from this location. Hence when Backup Exec creates the snapshot initially, the file is present, however during the backup process it is deleted by SEPM.

Solution:

1. This is a temporary update installation file for SEPM and it does not need to be backed up. Even if an exception is generated in Backup Exec job log, it is safe to ignore the same.
2. To avoid this warning exclude that file from the backup selection list.

 OEM16.INF

Error:
C:\windows\inf\oem16.inf
The following can be found in Windows Event Viewer on the virtual machine:

Event ID 12289 \ Source: VSS \ Type: Error \ Description: Volume Shadow copy Service error: Unexpected error VSS_E_WRITER_STATUS_NOT_AVAILABLE. An older active writer session state is being overwritten by a newer session. The most common cause is that the number of parallel backups has exceeded the maximum support limit. hr=0x80042409

Solution:
Manually install VSS on the VM per the following steps:

1. In the VMware Tools installer, select Modify > Drivers > VSS.
2. Complete the installation process.
3. Restart the virtual machine to make sure VSS components are installed and running.

For more information, review the following Microsoft document:

Error message when you perform a Volume Shadow Copy Service restore operation: "0x80042409"
<https://support.microsoft.com/kb/978773/en-us> 

 

BRSCV01A.EXE

Error:
File C:\Windows\System32\brsvc01a.exe is not present on the snapshot

Cause:
When Brother software for printer auto-upgrade is run on a machine, Brother Auto-Upgrade agent service is created and it has the following subkey in registry: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BrotherXP spl service TYPE Name Data REG_EXPAND_SZ ImagePath C:\Windows\System32\brsvc01a.exe Once upgrade is completed successfully, C:\Windows\System32\brsvc01a.exe is removed, however the service and its associated registry key are left behind.
If this key is still present at the time of the System State backup, the job will complete with the above exception.

Solution:

1. If the file listed in the above error is found on the server, exclude this file from the backup.

Warning: Incorrect use of the Windows registry editor may prevent the operating system from functioning properly. Great care should be taken when making changes to a Windows registry. Registry modifications should only be carried-out by persons experienced in the use of the registry editor application. It is recommended that a complete backup of the registry and workstation be made prior to making any registry changes.

2. If the file listed in the above error is NOT found on the server, delete the key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BrotherXP spl service (Note: This will be recreated when auto-upgrade is run next time).

3. Reboot the server and run another System State backup to verify that the job is no longer ending with the above exception.

S3CAP.SYS or STORFLT.SYS

Error: 
VSS Snapshot warning. File c:\windows\system32\drivers\storflt.sys is not present on the snapshot.
 
Solution:

1. Perform the one of following steps to allow the backups to complete as normal 
2. Use Notepad or WordPad to create a blank document
3. Rename the document to match the same file within the Backup Exec job log 
4. Place the file in the same directory as the missing file
5. After the copy is complete, perform backups as normal

For more information on storflt.sys and s3cap.sys plese refer to the following Microsoft KB article:

Event logged reporting storflt driver failed to load on restart after you install Windows Server 2008 SP2
<https://mskb.pkisolutions.com/kb/971527> 

HPSUMSERVERW32.EXE

Error:
File c:/windows\hpsum_1270941654 \hpsumserverw32.exe is not present on the snapshot

Solution:
Verify if this file hpsumserverw32.exe" is present in given path.

Warning: Incorrect use of the Windows registry editor may prevent the operating system from functioning properly. Great care should be taken when making changes to a Windows registry. Registry modifications should only be carried-out by persons experienced in the use of the registry editor application. It is recommended that a complete backup of the registry and workstation be made prior to making any registry changes.

If yes then check Image Path of this file in Windows registry. It should be mentioned like this - c:\windows\hpsum_1270941654 \hpsumserverw32.exe (if not mentioned as above, modify it and replace forward slash with back slash) 

 

OEM12.INF

Error:
The below error appears in the job log after a failed attempt to backup a Windows 2008 System State
Final error: 0xe000fedf - A failure occurred reading an object

The following can also be observed in the job log:
VSS Snapshot warning. File c:\windows\inf\oem12.inf is not present on the snapshot
V-79-57344-65247 - A failure occurred reading an object

Cause:
Issues with multiple files may cause the above error. As the job log does not include all problem files, debugging for the Remote Agent service should be enabled to confirm the specific files.
Note: When debugging, only "enable debug log for job engine and remote agent service" needs to be selected. Additionally, if the affected machine is a remote server, debugging of the server can still be enabled from beutility on the media server as instructed by using the branch "all remote agent computers" instead of "all media servers".

The debug log files will be located in \program files\symantec\backup exec\logs\[servername]-beremote[xx].log. Review the most recently modified file in this folder for examples of messages similar to the following:

[10300] Status 0x00000002 returned calling FindFirstFile for \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy75\windows\inf\oem12.inf in brUtil::GenerateFileList
[10300] brUtil::OpenActiveObject Error: 0xE0008485 Could not open the object msidcrl30.dll C:\Windows\winsxs\amd64_microsoft-windows-identitycrl_31bf3856ad364e35_6.0.6001.18000_none_adac6f6ef6bbe059\msidcrl30.dll

Solution:
In the above example, oem12.inf was actually missing - replacing the file was necessary. Also the msidcrl30.dll was corrupt - deleting the file was necessary. Msidcrl30.dll was confirmed as corrupt by using the Microsoft backup tool that can be installed with Windows 2008. This tool is not installed by default. Once installed, a system state only backup can be performed via the command line:

Note: Drive letter "e" can be any of the available drive letter apart from "C"

When the job has finished, any logs by default are saved in c:\windows\logs\windowserverbackup\*.log. Review the error log file to confirm which files cannot be backed up due to corruption. In this example, manually attempting to copy the file generated an access denied error, even when ownership permissions were assumed and full control given. If the file had been locked open by a running process then VSS should have been able to snapshot it therefore the file was corrupt.

Once any affected files have been identified, arrange to delete and/or replace any affected files
Note: Above step should only be performed post consultation with the system administrator or the software vendor.

LSI_SAS.SYS

Error:
Backup- \\SRV-EMPIRE79V\System?State
VSS Snapshot warning. File c:\windows\\systemroot\system32\drivers\lsi_sas.sys is not present on the snapshot.

Cause: 
The physical path of this file is incorrect in the registry

Solution:

Reinstalling VMTools should correct the path in the registry automatically.

If this does not work or cannot be performed, then try the following:

CAUTION: Symantec have receieved some information indicating that some virtualized servers may experience a crash on reboot after making the changes relating to LSI_SAS provided below, if this happens then try changing the SCSI Controller settings of the VM from "LSI Logic SAS" to "LSI Logic Parallel". If you have concerns about this then as per the information earlier in this document please contact VMware for information on how to clean up the LSI_SAS registration that causes the system state backup problem.

 

1. Open registry editor and go to this location
   
   Warning: Incorrect use of the Windows registry editor may prevent the operating system from functioning properly. Great care should be taken when making changes to a Windows registry. Registry modifications should only be carried-out by persons experienced in the use of the registry editor application. It is recommended that a complete backup of the registry and workstation be made prior to making any registry changes.
   
       HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\LSI_SAS\ImagePath
    
2. If the original ImagePath String = systemroot\system32\drivers\lsi_sas.sys then compare the path used on similar systems in your environment. It should be one of the following values: 
   %systemroot%\system32\drivers\lsi_sas.sys
   system32\drivers\lsi_sas.sys
    
3. Enter and save the appropriate path. If the registry key is already set to one of the bulleted values, then the issue might be too many controller drivers being loaded at boot time. Refer to the following article for instructions on changing the Start value for the extra drivers in the registry:
   https://zadood.blogspot.com/2012/01/how-to-fix-windows-2008-r2-system-state.html
    
4. Restart the media server and re-run the backup of the System State to verify the solution.
   wbadmin start systemstatebackup -backuptarget:e:

Saposcol.exe 

System State backup of a Windows 2008 server where SAP service is running may complete with an exception given below.

Error:
"VSS Snapshot warning. File c:/windows\sapcluster\saposcol.exe is not present on the snapshot."

Cause:

VSS Snapshot cannot recognize the path name for SAPOSCOL service correctly because /(slash) is included instead of \ (back slash).

Solution:

Follow the steps provided below on the Windows Server where SAP service is running:

1. Stop SAPOSCOL service (Windows service for saposcol.exe).
    
2. Open Registry Editor
   
   Warning: Incorrect use of the Windows registry editor may prevent the operating system from functioning properly. Great care should be taken when making changes to a Windows registry. Registry modifications should only be carried-out by persons experienced in the use of the registry editor application. It is recommended that a complete backup of the registry and workstation be made prior to making any registry changes.
    
3. Browse to System\CurentControlSet\Services\sapcluster and check the value of string "ImagePath".
   If the "ImagePath" shows c:/windows\sapcluster\saposcol.exe, edit it to c:\windows\sapcluster\saposcol.exe.
    
4. Start SAPOSCOL service.

Smcinst.exe 

System State backup of a Windows 2008 server completes with an exception "VSS Snapshot warning. File C:\program files\Symantec\Symantec endpoint protection\smclu\setup\smcinst.exe is not present on the snapshot."

Backing up the System State of a Windows 2008 using Backup Exec with Symantec Endpoint Protection installed, the backup completes with exception as shown in the figure below.

Warning: Incorrect use of the Windows registry editor may prevent the operating system from functioning properly. Great care should be taken when making changes to a Windows registry. Registry modifications should only be carried-out by persons experienced in the use of the registry editor application. It is recommended that a complete backup of the registry and workstation be made prior to making any registry changes. 

When Symantec Endpoint Protection (SEP) auto-upgrade is first run on a machine, SEP Auto-Upgrade agent service is created and it has the following subkey in registry:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Smcinst

TYPE Name Data REG_EXPAND_SZ

ImagePath X:\Program Files\Symantec\Symantec Endpoint Protection\SmcLU\Setup\smcinst.exe.  

Once upgrade is completed successfully, X:\Program Files\Symantec\Symantec Endpoint Protection\SmcLU\Setup folder is removed, however the service and its associated registry key are left behind.

Note : X:\ is the drive in which SEP is installed

If this key is still present at the time of the System State backup, the job will complete with the above exception.

A workaround to allow backup program to complete successfully is to delete HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Smcinst subkey. However, please note that it will be recreated when auto-upgrade is run next time.

Workaround:

1. If the file listed in the above error is found on the server, exclude this file from the backup.
2. If the file listed in the above error is not found on the server, review HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Smcinst\ImagePath 
3. If the "ImagePath" value of Windows registry key list the exact same path as seen in the above error, export the Windows Registry Key and delete the "ImagePath" value only 
4. Reboot the server and run another System State backup to verify that the job is no longer ending with the above exception.

Backup of System State completes with the VSS  Snapshot Warning: File C:\Program Files (x86)\Common Files\Symantec Shared\ccsvchst.exe is not present on the snapshot.

Cause:
A common cause for this issue is registry keys left behind from a previous installation of Symantec End-Point Protection (SEP). Remnants can stay in the registry that are directed at files and directories that no longer exist on the system. These registry remnants are flagged to be backed up in System State backups.

In this instance there are two services that are directed at the C:\Program Files (x86)\common files\symantec shared for the ccsvchst.exe file. If this was an upgrade to the latest version of SEP, the new version of SEP has the file in a different location than previous versions and some registry keys may still remain.

Solution:
In order to resolve this issue the following registry keys must be removed from the affected systems:

Warning: Incorrect use of the Windows registry editor may prevent the operating system from functioning properly. Great care should be taken when making changes to a Windows registry. Registry modifications should only be carried-out by persons experienced in the use of the registry editor application. It is recommended that a complete backup of the registry and workstation be made prior to making any registry changes.

1. Go to Start > Run > regedit
2. Browse to HKEY_LOCAL_MACHINE | SYSTEM | CurrentControlSet | services
3. Delete both the ccEvtMgr and ccSetMgr keys.
4. Run System State backup of the affected system to verify the warning is gone.

This error has been seen on the following files also. Where solution is the same, install the application and remove it properly by consulting the software vendor or workaround by creating  a dummy file in the path that VSS says are not present in the system.

Backup- System?State VSS Snapshot warning. File c:\windows\system32\drivers\emcpbase.sys is not present on the snapshot.
VSS Snapshot warning. File c:\windows\system32\drivers\emcpsapi.sys is not present on the snapshot.
VSS Snapshot warning. File c:\windows\system32\drivers\emcpclass.sys is not present on the snapshot.
VSS Snapshot warning. File c:\windows\system32\vnetinst.dll is not present on the snapshot.
VSS Snapshot warning. File c:\program files (x86)\vmware\vmware server\vmware-authd.exe is not present on the snapshot.
VSS Snapshot warning. File c:\windows\inf\oem27.inf is not present on the snapshot.
VSS Snapshot warning. File c:\windows\inf\oem28.inf is not present on the snapshot.
VSS Snapshot warning. File c:\windows\inf\oem29.inf is not present on the snapshot.
VSS Snapshot warning. File c:\windows\system32\drivers\emcpcg.sys is not present on the snapshot.
VSS Snapshot warning. File c:\program files (x86)\vmware\vmware server\vmserverdwin32.exe is not present on the snapshot.
VSS Snapshot warning. File c:\windows\system32\drivers\emcmpio.sys is not present on the snapshot.
VSS Snapshot warning. File c:\windows\system32\drivers\emcpgpx.sys is not present on the snapshot.
VSS Snapshot warning. File c:\windows\system32\drivers\vmnetadapter.sys is not present on the snapshot.
VSS Snapshot warning. File c:\windows\system32\emcpcoinst30.dll is not present on the snapshot.
VSS Snapshot warning.  File c:\windows\inf\oem41.inf is not present on the snapshot.

Note: Normally registry entries gets updated once the server is rebooted, if a program had been uninstalled but server could not be rebooted, then rebooting the server later should also clear the registry entries.

System State backup of a Windows 2008 server may complete with the following exception if a driver file(s) was deleted/renamed. For example 04mmdat.sys is casing the exception in the error below:

Error:

Backup-System?State System?State
VSS Snapshot warning. File C:\windows\inf\oem6.inf is not present on the snapshot.
VSS Snapshot warning. File c:\windows\system32\drivers\04mmdat.sys is not present on the sanpshot.

If Windows Deployment Service is running on the server, System State backup of that server may complete with an exception like below:

VSS Snapshot warning. File D:\RemoteInsta\Setup\*.* /s is not present on the snapshot.

Cause:
Volume Shadow Copy Service (VSS) System Writer may list a file to be backed up even though the file is no longer present on the server. View the {GUID.EN_US}-System_Writer.xml file located in the directory C:\Program Files\Symantec\Backup Exec\Logs to confirm if the writer lists the file present as an exception in the job log.

Note: The exception can be safely ignored as it does not affect the functionality of the Backup set.

Workaround:

Follow the steps listed below:

1. Create a empty text file with the same name as the file mentioned in the exception
2. Place the document in the same location as in the exception
3. For the Remote install related Exception, create a folder named "Setup" in the path mentioned in the exception.
   i.e, D:\Remote install\Setup.