9782 » Windows XP NTBackup.exe issues a 'Volume Shadow Copy Service' error and the Application event log records Event ID 5013 or 12302? 05-Oct-05
When running NTBackup.exe to perform a backup, a restore, or a volume shadow copy, you receive an error like:
Volume Shadow Copy Service error: Shadow Copy writer ContentIndexingService called routine RegQueryValueExW which failed with status 0x80070002 (converted to 0x800423f4)
The Application event log records an event similar to one of the following:
Event Type: Error
Event Source: VSS
Event Category: None
Event ID: 5013
Date: MM/DD/YYYY
Time: HH:MM:SS
User: N/A
Computer: <ComputerName>
Description: Volume Shadow Copy Service error: Shadow Copy writer ContentIndexingService called routine RegQueryValueExW which failed with status 0x80070002 (converted to 0x800423f4). For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data: 0000: 57 53 48 43 4f 4d 4e 43 WSHCOMNC 0008: 32 32 39 32 00 00 00 00 2292.... 0010: 57 53 48 43 49 43 00 00 WSHCIC.. 0018: 32 38 37 00 00 00 00 00 287.....
Event Type: Error
Event Source: VSS
Event Category: None
Event ID: 12302
Date: MM/DD/YYYY
Time: HH:MM:SS
User: N/A
Computer: <ComputerName>
Description: Volume Shadow Copy Service error: An internal inconsistency was detected in trying to contact shadow copy service writers. Please check to see that the Event Service and Volume Shadow Copy Service are operating properly. For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
The behavior is indicative of a missing Location Value Name in one or more sub-keys of
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ContentIndex\Catalogs. This problem is generally the result of a program uninstall
deleting the Location Value Name instead of the entire sub-key.
NOTE: The default sub-keys, and their Value Names, are:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ContentIndex\Catalogs\System
Location REG_SZ C:\System Volume Information
IsIndexingW3Svc REG_DWORD 0x0
IsIndexingNNTPSvc REG_DWORD 0x0
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ContentIndex\Catalogs\web
Location REG_SZ c:\inetpub
IsIndexingW3Svc REG_DWORD 0x1
IsIndexingNNTPSvc REG_DWORD 0x0
W3SvcInstance REG_DWORD 0x1
GenerateCharacterization REG_DWORD 0x1
FilterFilesWithUnknownExtensions REG_DWORD 0x0
MaxCharacterization REG_DWORD 0x140I have scripted CILoc.bat to list any sub-keys that have a missing Location
Value Name. The syntax for using CILoc.bat is:
CILoc [ComputerName]
Where ComputerName is an optional NetBIOS computer name. If missing, the local computer is checked.
CILoc.bat contains:
@echo off
setlocal ENABLEDELAYEDEXPANSION
set comp=%computername%
if {%1} NEQ {} set comp=%1
set comp=%comp:"=%
set comp=\\%comp:\=%
set key=HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ContentIndex\Catalogs
for /f "Tokens=*" %%a in ('REG QUERY %comp%\%key% ^|find /i "%key%\"') do (
set wrk1=%%a
call set wrk2=!wrk1:%key%=!
set OK=N
for /f "Tokens=1" %%x in ('REG QUERY %comp%\!wrk1! /V Location^|find /i "Location"') do set OK=Y
if "!OK!" EQU "N" @echo Location missing: %comp%\%%a
)
endlocal
If a sub-key with a missing Location is listed, delete the sub-key if the program has been uninstalled. If the program is installed,
use Regedit.exe to add the Location Value Name, a REG_SZ data type, with the correct folder path.
End of Article
Register
