Many Sharing Violations with v7.7

[dave0823]

Hi -

 

Product: Single Server Disk-to-Disk

Version 7.7.325 (64-bit)

Driver Update and HotFix, version 7.7.3.102 (64-bit)

Operating System: Microsoft 7 (64-bit)

 

I get multiple sharing violations when performing a backup to a Windows 7 system - as well as an ASR Writer backup failed error. The operating system (source) is configured as Raid 1 (mirrored) and the target backup media is a basic (non-raid) NTFS drive.

 

- 01/06/2010 2:58:22 PM: Copying Local Disk (C:)

File "C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log": can't read, error -1020 ( sharing violation)

File "C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSStmp.log": can't read, error -1020 ( sharing violation)

File "C:\ProgramData\Microsoft\Search\Data\Applications\Windows\tmp.edb": can't read, error -1020 ( sharing violation)

File "C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.edb": can't read, error -1020 ( sharing violation)

File "C:\ProgramData\Microsoft\Windows Defender\IMpService925A3ACA-C353-458A-AC8D-A7E5EB378092.lock": can't read, error -1020 ( sharing violation)

File "C:\ProgramData\Microsoft\Windows Defender\Scans\History\CacheManager\MpSfc.bin": can't read, error -1020 ( sharing violation)

File "C:\System Volume Information\Syscache.hve": can't read, error -1020 ( sharing violation)

File "C:\System Volume Information\Syscache.hve.LOG1": can't read, error -1020 ( sharing violation)

File "C:\System Volume Information\Syscache.hve.LOG2": can't read, error -1020 ( sharing violation)

File "C:\System Volume Information\{3808876b-c176-4e48-b7ae-04046e6cc752}": can't read, error -1017 ( insufficient permissions)

File "C:\System Volume Information\{5500c1ee-6cea-11df-a388-0017fad29579}{3808876b-c176-4e48-b7ae-04046e6cc752}": can't read, error -1017 ( insufficient permissions)

File "C:\System Volume Information\{5500c217-6cea-11df-a388-0017fad29579}{3808876b-c176-4e48-b7ae-04046e6cc752}": can't read, error -1017 ( insufficient permissions)

File "C:\System Volume Information\{5500c2b6-6cea-11df-a388-0017fad29579}{3808876b-c176-4e48-b7ae-04046e6cc752}": can't read, error -1017 ( insufficient permissions)

File "C:\Users\Administrator\ntuser.dat": can't read, error -1020 ( sharing violation)

File "C:\Users\Administrator\ntuser.dat.LOG1": can't read, error -1020 ( sharing violation)

File "C:\Users\Administrator\ntuser.dat.LOG2": can't read, error -1020 ( sharing violation)

File "C:\Users\Administrator\AppData\Local\Microsoft\Windows\UsrClass.dat": can't read, error -1020 ( sharing violation)

File "C:\Users\Administrator\AppData\Local\Microsoft\Windows\UsrClass.dat.LOG1": can't read, error -1020 ( sharing violation)

File "C:\Users\Administrator\AppData\Local\Microsoft\Windows\UsrClass.dat.LOG2": can't read, error -1020 ( sharing violation)

File "C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT.LOG1": can't read, error -1020 ( sharing violation)

File "C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT.LOG2": can't read, error -1020 ( sharing violation)

File "C:\Windows\ServiceProfiles\LocalService\ntuser.dat": can't read, error -1020 ( sharing violation)

File "C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT.LOG1": can't read, error -1020 ( sharing violation)

File "C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT.LOG2": can't read, error -1020 ( sharing violation)

File "C:\Windows\ServiceProfiles\NetworkService\ntuser.dat": can't read, error -1020 ( sharing violation)

File "C:\Windows\System32\config\RegBack\DEFAULT": can't read, error -1020 ( sharing violation)

File "C:\Windows\System32\config\RegBack\SAM": can't read, error -1020 ( sharing violation)

File "C:\Windows\System32\config\RegBack\SECURITY": can't read, error -1020 ( sharing violation)

File "C:\Windows\System32\config\RegBack\SOFTWARE": can't read, error -1020 ( sharing violation)

File "C:\Windows\System32\config\RegBack\SYSTEM": can't read, error -1020 ( sharing violation)

File "C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTDiagLog.etl": can't read, error -1020 ( sharing violation)

File "C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTEventLog-Application.etl": can't read, error -1020 ( sharing violation)

File "C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTEventLog-ForwardedEvents.etl": can't read, error -1020 ( sharing violation)

File "C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTEventLog-System.etl": can't read, error -1020 ( sharing violation)

File "C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTEventlog-Security.etl": can't read, error -1020 ( sharing violation)

File "C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTMsMpPsSession7.etl": can't read, error -1020 ( sharing violation)

File "C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTUBPM.etl": can't read, error -1020 ( sharing violation)

Writer "ASR Writer" backup failed, error -1017 ( insufficient permissions).

01/06/2010 3:03:10 PM: Snapshot stored, 249.1 MB

01/06/2010 3:03:21 PM: 37 execution errors

Remaining: 39 files, 10.0 GB

Completed: 172 files, 129.9 MB

Performance: 865.7 MB/minute

Duration: 00:04:59 (00:04:50 idle/loading/preparing)

 

From the Windows event viewer:

 

Source: VSS

Event ID: 30

Fail to acquire Security Audit privilege.

Security Audits for shadow copy creation and import will not be logged. 0x80070514, Not all privileges or groups referenced are assigned to the caller.

 

Source: VSS

Event ID: 8193

Volume Shadow Copy Service error: Unexpected error calling routine IVssAsrWriterBackup::GetDiskComponents. hr = 0x80070057, The parameter is incorrect.

.

 

Operation:

OnIdentify event

Gathering Writer Data

 

Context:

Execution Context: ASR Writer

Writer Class Id: {be000cbe-11fe-4426-9c58-531aa6355fc4}

Writer Name: ASR Writer

Writer Instance ID: {3fac34c4-8bf8-4617-8ae9-6ed8b8953f66}

 

Source: Retrospect

Event ID: 3

The description for Event ID 3 from source Retrospect cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.

 

If the event originated on another computer, the display information had to be saved with the event.

 

The following information was included with the event:

 

Writer "ASR Writer" backup failed, error -1017 ( insufficient permissions).

 

The specified resource type cannot be found in the image file

 

Source: VSS

Event: 8193

Volume Shadow Copy Service error: Unexpected error calling routine Check OnIdentifyError. hr = 0x80070057, The parameter is incorrect.

.

 

Operation:

PrepareForBackup event

 

Context:

Execution Context: ASR Writer

Execution Context: Writer

Writer Class Id: {be000cbe-11fe-4426-9c58-531aa6355fc4}

Writer Name: ASR Writer

Writer Instance ID: {1f286ed2-0508-4b57-97b2-dc5260d38eb0}

 

Error-specific details:

ASR Writer: The parameter is incorrect. (0x80070057)

 

Any suggestions to get this working would be greatly appreciated!

 

Thanks,

Dave

[dave0823]

Is there not anyone from Retrospect support that can comment? This seems to be a bug with Retrospect and I can't believe there are no solutions or recommendations that can be provided to aid in resolution of this issue(s).

 

I have been able to backup successfully using Microsoft Backup and Acronis - which leads me to believe this is indeed a bug with the Retrospect software. I prefer to use Retrospect for my backups but I may need to move on and use Acronis instead.

 

Thanks,

Dave

[Lennart_T]

Is there not anyone from Retrospect support that can comment?

This is a user-to-user forum.

Contact Retrospect support

[bstaud]

I am going to try to resurrect this discussion because we have the same problem on several different client machines on several different sites, and I have yet to find a full solution. Mostly I want to name the suspects in my experience. 1) Norton Internet Security places peculiar file attributes on its files, and they always hit this problem. 2) For other files, whether Open File Backup is checked, without the paid Add-In being in place. 3) For some machines, VSS in Windows gets its knickers in a twist for reasons unknown.

 

For similar entries in the Log, we use the exclude Selector to leave whole Folders out of the backup. Of course if they are really needed in a restore, well, too bad. Curiously, other machines at the same sites get through with zero errors.

 

This behavior happens on XP and on Windows 7, on Retrospect 7.6, 7.7, and 8; on Disk-to-Disk and on Retrospect Pro. Of course, there may be different reasons on different machine/environments, but it looks like a more general problem affecting all of them.

 

Hints about what to try next would be appreciated.

[David W Lee]

There are separate issues:

 

File "C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log": can't read, error -1020 ( sharing violation)

...

 

The Open File Backup license and enabling it as a Backup option are required to back up certain files that are opened most of the time.

 

Source: VSS

Event ID: 30

Fail to acquire Security Audit privilege.

Security Audits for shadow copy creation and import will not be logged. 0x80070514, Not all privileges or groups referenced are assigned to the caller.

...

Writer "ASR Writer" backup failed, error -1017 ( insufficient permissions).

 

It appears that Retrospect isn't running from an account in the Administrator group. That is required in order to use Microsoft VSS to backup system state (including registry, etc.).

 

without the paid Add-In being in place...

on Disk-to-Disk and on Retrospect Pro

 

See the comments above.

[bstaud]

'bstaud', on 22 Mar 2013 - 4:11 PM, said:

without the paid Add-In being in place...
on Disk-to-Disk and on Retrospect Pro

"Employee" said:

See the comments above.

 

 

Except that

http://www.retrospect.com/products/win/addons

 

seems to say that Professional does open files without the add-on

[1] Separate Open File Backup add-ons are available for Server and Disk-to-Disk editions; Retrospect Professional includes the ability to protect open files on Windows desktops and laptops.

[bstaud]

"Employee" said

> It appears that Retrospect isn't running from an account in the Administrator group. That is required in order to use Microsoft VSS to backup system state (including registry, etc.).

 

On the "server" end or on the Client end?

I am asking because some, not all, of the Clients present the VSS error.