Windows Event ID 47 – Volsnap: Volume Shadow Copy Service Warning

Start by examining shadow copy storage allocation and usage across all volumes.

1. Open Command Prompt as Administrator
2. Check current shadow copy storage configuration:

   vssadmin list shadowstorage

3. Review available disk space on all volumes:

   Get-WmiObject -Class Win32_LogicalDisk | Select-Object DeviceID, Size, FreeSpace, @{Name='FreeSpaceGB';Expression={[math]::Round($_.FreeSpace/1GB,2)}}

4. Check shadow copy usage details:

   vssadmin list shadows

5. If storage is full, increase shadow copy storage allocation:

   vssadmin resize shadowstorage /for=C: /on=C: /maxsize=20GB

6. Alternatively, delete old shadow copies to free space:

   vssadmin delete shadows /for=C: /oldest

Examine the complete Event ID 47 details to identify specific failure causes and affected volumes.

1. Open Event Viewer → Windows Logs → System
2. Filter for Event ID 47 from Volsnap source:

   Get-WinEvent -FilterHashtable @{LogName='System'; Id=47; ProviderName='volsnap'} -MaxEvents 20 | Format-Table TimeCreated, Id, LevelDisplayName, Message -Wrap

3. Check Application log for related VSS errors:

   Get-WinEvent -FilterHashtable @{LogName='Application'; Id=8193,8194,8195} -MaxEvents 10

4. Review VSS operational logs for detailed information:

   Get-WinEvent -LogName 'Microsoft-Windows-VolumeSnapshot-Driver/Operational' -MaxEvents 50

5. Export events for analysis:

   Get-WinEvent -FilterHashtable @{LogName='System'; Id=47} | Export-Csv C:\temp\event47_analysis.csv -NoTypeInformation

6. Correlate timing with backup schedules and system activities

Restart VSS components and clear potentially corrupted shadow copy metadata.

1. Stop dependent services first:

   Stop-Service -Name 'BITS', 'wuauserv', 'CryptSvc' -Force

2. Stop the Volume Shadow Copy service:

   Stop-Service -Name 'VSS' -Force

3. Clear shadow copy storage (this removes all existing shadow copies):

   vssadmin delete shadows /all /quiet

4. Reset VSS writers:

   vssadmin list writers

5. Restart the VSS service:

   Start-Service -Name 'VSS'

6. Restart dependent services:

   Start-Service -Name 'BITS', 'wuauserv', 'CryptSvc'

7. Verify VSS functionality:

   vssadmin create shadow /for=C:

8. Check for new Event ID 47 occurrences after testing

Investigate underlying storage subsystem performance that may be causing shadow copy failures.

1. Check disk health using built-in diagnostics:

   Get-PhysicalDisk | Get-StorageReliabilityCounter | Select-Object DeviceId, Temperature, ReadErrorsTotal, WriteErrorsTotal

2. Monitor disk performance counters:

   Get-Counter '\PhysicalDisk(*)\Avg. Disk Queue Length', '\PhysicalDisk(*)\% Disk Time' -SampleInterval 5 -MaxSamples 12

3. Run comprehensive disk check:

   chkdsk C: /f /r /x

4. Check for storage driver issues in Device Manager:

   Get-WmiObject Win32_PnPEntity | Where-Object {$_.ConfigManagerErrorCode -ne 0} | Select-Object Name, ConfigManagerErrorCode

5. Review storage-related events:

   Get-WinEvent -FilterHashtable @{LogName='System'; Id=7,11,51,153} -MaxEvents 20

6. Test storage performance using diskspd or similar tools
7. Update storage controller drivers and firmware if issues are detected

Perform deep analysis of VSS configuration and registry settings for advanced troubleshooting.

1. Backup VSS registry settings before making changes:

   reg export HKLM\SYSTEM\CurrentControlSet\Services\VSS C:\temp\vss_backup.reg

2. Check VSS service configuration:

   Get-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Services\VSS'

3. Examine shadow copy provider registration:

   vssadmin list providers

4. Check for corrupted VSS writers:

   vssadmin list writers | Select-String 'Writer name\|State'

5. Re-register VSS components if corruption is detected:

   cd /d %windir%\system32
   regsvr32 /s ole32.dll
   regsvr32 /s oleaut32.dll
   regsvr32 /s vss_ps.dll

6. Reset shadow copy storage configuration:

   reg delete 'HKLM\SYSTEM\CurrentControlSet\Services\VSS\Settings' /f

7. Restart the system and monitor for Event ID 47 recurrence
8. Configure enhanced VSS logging for ongoing monitoring:

   reg add 'HKLM\SYSTEM\CurrentControlSet\Services\VSS\Debug' /v 'Trace' /t REG_DWORD /d 1