JSI Tip 9782. Windows XP NTBackup.exe issues a 'Volume Shadow Copy Service' error and the Application event log records Event ID 5013 or 12302?

When running NTBackup.exe to perform a backup, a restore, or a volume shadow copy, you receive an error like:

Volume Shadow Copy Service error: Shadow Copy writer ContentIndexingService called routine RegQueryValueExW which failed with status 0x80070002 (converted to 0x800423f4)

The Application event log records an event similar to one of the following:

Event Type: Error
Event Source: VSS
Event Category: None
Event ID: 5013
Date: MM/DD/YYYY
Time: HH:MM:SS
User: N/A
Computer: <ComputerName>
Description: Volume Shadow Copy Service error: Shadow Copy writer ContentIndexingService called routine RegQueryValueExW which failed with status 0x80070002 (converted to 0x800423f4). For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data: 0000: 57 53 48 43 4f 4d 4e 43 WSHCOMNC 0008: 32 32 39 32 00 00 00 00 2292.... 0010: 57 53 48 43 49 43 00 00 WSHCIC.. 0018: 32 38 37 00 00 00 00 00 287.....

Event Type: Error
Event Source: VSS
Event Category: None
Event ID: 12302
Date: MM/DD/YYYY
Time: HH:MM:SS
User: N/A
Computer: <ComputerName>
Description: Volume Shadow Copy Service error: An internal inconsistency was detected in trying to contact shadow copy service writers. Please check to see that the Event Service and Volume Shadow Copy Service are operating properly. For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

The behavior is indicative of a missing Location Value Name in one or more sub-keys of HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ContentIndex\Catalogs. This problem is generally the result of a program uninstall deleting the Location Value Name instead of the entire sub-key.

NOTE: The default sub-keys, and their Value Names, are:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ContentIndex\Catalogs\System
    Location    REG_SZ  C:\System Volume Information
    IsIndexingW3Svc     REG_DWORD       0x0
    IsIndexingNNTPSvc   REG_DWORD       0x0

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ContentIndex\Catalogs\web
    Location    REG_SZ  c:\inetpub
    IsIndexingW3Svc     REG_DWORD       0x1
    IsIndexingNNTPSvc   REG_DWORD       0x0
    W3SvcInstance       REG_DWORD       0x1
    GenerateCharacterization    REG_DWORD       0x1
    FilterFilesWithUnknownExtensions    REG_DWORD       0x0
    MaxCharacterization REG_DWORD       0x140

I have scripted CILoc.bat to list any sub-keys that have a missing Location Value Name. The syntax for using CILoc.bat is:

CILoc \[ComputerName\]

Where ComputerName is an optional NetBIOS computer name. If missing, the local computer is checked.

CILoc.bat contains:

@echo off
setlocal ENABLEDELAYEDEXPANSION
set comp=%computername%
if \{%1\} NEQ \{\} set comp=%1
set comp=%comp:"=%
set comp=\\%comp:\=%
set key=HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ContentIndex\Catalogs
for /f "Tokens=*" %%a in ('REG QUERY %comp%\%key% ^|find /i "%key%\"') do (
 set wrk1=%%a
 call set wrk2=!wrk1:%key%=!
 set OK=N
 for /f "Tokens=1" %%x in ('REG QUERY %comp%\!wrk1! /V Location^|find /i "Location"') do set OK=Y
 if "!OK!" EQU "N" @echo Location missing: %comp%\%%a
)
endlocal

If a sub-key with a missing Location is listed, delete the sub-key if the program has been uninstalled. If the program is installed, use Regedit.exe to add the Location Value Name, a REG_SZ data type, with the correct folder path.

Comments

Plain text