VSS snapshot troubles

[lensv]

Another probelm with VMware Converter (ver. 4). Local conversion fails after a few seconds with the following status:

FAILED: Unable to create a VSS snapshot of the source volume(s). Error code:

2147754767 (0x8004230F).

Source machine, Windows XP SP3

What might be the problem this time? (Error logs attached)

[lensv]

Anyone with ideas here? I'd be very grateful for some help with this issue...

[jokke]

Could be several things;

What filesystem do you have on your disks?

Do you have enough space left on the disk for the vss snapshot?

How many disks are connected and mounted?

What does your partition table look like?

Is your windows vss service working?

Joakim

[lensv]

Thanks for your input! I reply between the lines...

What filesystem do you have on your disks?

NTFS on both disks

Do you have enough space left on the disk for the vss snapshot?

Absolutely (at least 60% free space on both disks)

How many disks are connected and mounted?

Except for the internal disk there is only one USB-disk attached, which also is the target destination.

What does your partition table look like?

I don't quite follow you here. Can you explain...

Is your windows vss service working?

Yes

[jokke]

I meant how your internal harddisk is partitioned.

Is it one large primary partition (C)?

Is it split in 2 primary partitions (C and D)?

Do you have logical partitions as well (C, D, E..)

Is it a dynamic disk or a basic disk?

What software did you use when you partitioned the disk?

Joakim

[lensv]

Hi,

The internal hard drive is a basic disk with two partitions (C: and D:), but I'm only cloning C:. The target USB-drive is a dynamic disk containing one single primary partition. Both drives are partitioned with Windows XP's Disk Manager.

Regarding WMI... Are you referring to the WMI Performance Adapter service? It is the only WMI service that I can find on this system. This service cannot be started though (Error 0x80040154: Class not registered). Could this be the cause of the failure?

Unfortunately I have no backup image to try with...

[jokke]

No not that one, you should have "Windows Management Instrumentation" or "winmgmt".

Try this command;

"net start winmgmt"

Post what you get with this command;

"sc queryex winmgmt"

If the "Windows Management Instrumentation" service is missing on your system install it with attached script and reboot.

[IamTHEvilONE]

lensv,

the error code 0x8004230F is actually about the Microsoft VSS Writer itself, though it more commonly happens outside XP (http://support.microsoft.com/kb/924262). You should see the error messages in the Windows Event Viewer under VSS. If you can fix those error messages, then the conversion should complete fine.

Worst case scenario I have seen VSS needing to be re-registered ... something along these lines:

http://support.microsoft.com/kb/940032

And make sure that the "MS Software Shadow Copy Provider" is on manual, same with the "Volume Shadow Copy Service" being on manual as well.

Regards,

EvilOne

VMware vExpert 2009

NOTE: If your problem or questions has been resolved, please mark this thread as answered and award points accordingly.

[lensv]

Sorry for my late reply here...

The WMI service was missing, but now it's up running again. The problem seems to be related to "MS Software Shadow Copy Provider" though, since when I try to start this service I get the following error message:

"Could not Start the MS Software Shadow Copy Provider Service on Local Computer. Error 1053: The Service did not Respond to the Start or Control Request in a Timely Fashion".

I have looked at the links that "EvilOne" provided, but unfortunately I found no solution there (mostly server issuses there btw). I don't seem to find any applicable information at all about this problem when I search the Internet...

Maybe someone eles is more successful... Any help is appreciated!

[jokke]

That link is for installing vss only. Check that you have the required binaries for MS Software Shadow Copy Provider Service. Is the servce installed at all, or just misconfigured?

If all else fails, resort to coldcloning with version 3.x.

[lensv]

How can I tell if this service is misconfigured?

[jokke]

what does "sc queryex swprv" return? What about "sc quryex comsysapp"? Do you have swprv.dll in %SystemRoot%\system32?

[lensv]

Thanks Jokke (for trying to help)!

Swprv.dll is in place alright. Output from your suggested commands comes here...

sc queryex swprv

SERVICE_NAME: swprv

TYPE : 10 WIN32_OWN_PROCESS

STATE : 1 STOPPED

(NOT_STOPPABLE,NOT_PAUSABLE,IGNORES_SHUTDOWN)

WIN32_EXIT_CODE : 0 (0x0)

SERVICE_EXIT_CODE : 0 (0x0)

CHECKPOINT : 0x0

WAIT_HINT : 0x0

PID : 0

FLAGS :

sc queryex comsysapp

SERVICE_NAME: comsysapp

TYPE : 10 WIN32_OWN_PROCESS

STATE : 1 STOPPED

(NOT_STOPPABLE,NOT_PAUSABLE,IGNORES_SHUTDOWN)

WIN32_EXIT_CODE : 1077 (0x435)

SERVICE_EXIT_CODE : 0 (0x0)

CHECKPOINT : 0x0

WAIT_HINT : 0x0

PID : 0

FLAGS :

Hopefully you can make something out of this...

[jokke]

That seems fine.

Post output of "reg query hklm\SYSTEM\ControlSet001\Services\SwPrv /s"

Now try "sc start swprv" and post the output.

Joakim

[lensv]

reg query hklm\system\controlset001\services\swprv /s

! REG.EXE VERSION 3.0

HKEY_LOCAL_MACHINE\system\controlset001\services\swprv

Type REG_DWORD 0x10

Start REG_DWORD 0x3

ErrorControl REG_DWORD 0x0

ImagePath REG_EXPAND_SZ C:\WINDOWS\system32\dllhost.exe /Processid:{C615

7930-4945-4021-A32F-94DDFE09BBF2}

DisplayName REG_SZ MS Software Shadow Copy Provider

DependOnService REG_MULTI_SZ rpcss\0\0

DependOnGroup REG_MULTI_SZ \0

ObjectName REG_SZ LocalSystem

Description REG_SZ Manages software-based volume shadow copies taken by the

Volume Shadow Copy service. If this service is stopped, software-based volume s

hadow copies cannot be managed. If this service is disabled, any services that e

xplicitly depend on it will fail to start.

HKEY_LOCAL_MACHINE\system\controlset001\services\swprv\Security

Security REG_BINARY 01001480900000009C000000140000003000000002001C00

0100000002801400FF010F00010100000000000100000000020060000400000000001400FD010200

01010000000000051200000000001800FF010F000102000000000005200000002002000000001400

8D01020001010000000000050B00000000001800FD01020001020000000000052000000023020000

010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\system\controlset001\services\swprv\Enum

0 REG_SZ Root\LEGACY_SWPRV\0000

Count REG_DWORD 0x1

NextInstance REG_DWORD 0x1

sc start swprv

StartService FAILED 1053:

The service did not respond to the start or control request in a timely fashion.

sc start comsysapp

StartService FAILED 1053:

The service did not respond to the start or control request in a timely fashion.

Any ideas?

[jokke]

Can you verify that the service is not disabled?

Look at the attached picture.

[jokke]

attachment

[jokke]

wtf, unauthorized???

[jokke]

Maybe I'm not allowed to attach images..

The service I meant was COM+ (comsysapp). Verify it's not disabled.

Joakim

[lensv]

The COM+ System Application service is not disabled. It is set to "manual", but it don't seem to like being started :smileysad:

[jokke]

What does your event logs say about this?

Seriously. if you have a damaged COM+ catalog, it will take some effort to fix it. I know how to do it, done it several times, but you better be 100% sure it is damaged before going through this.

I would certainly recommend you to do a coldclone of your system instead. You will ofcourse clone this COM+ problem into the virtual machine...

Joakim

[lensv]

Sorry, I'm not at the "troubled" computer at the moment, so I cannot give you any Event log details right now.

I can tell you though that I have tried to repair the whole system once by reinstalling (upgrade) Windows XP SP3 from its CD. As far as I can tell that went well, so if the COM+ catalog is damaged Windows setup didn't notice...

[jokke]

I don't think the product cd is able to repair COM+. There is no tool able to do so that I am aware of. It is manual removal and manual install.

It might be even faster to boot your computer with a coldclone cd.

Here's a link to the easiest method of accomplishing this if you don't have one;

http://communities.vmware.com/docs/DOC-9800

Joakim

[lensv]

Hi,

I found this solution to fix the COM+ problem and it actually went well. Unfortunately the MS Software Shadow Copy Provider service still won't start. The only message in the Event Viewer is the following (in the System Log), Event ID: 7009...

Timeout (30000 milliseconds) waiting for the MS Software Shadow Copy Provider service to connect.

For more information, see Help and Support Center at .

The link from MS is worth nothing. Google don't seem to be my friend either. Why won't this f****** service play ball? I really want to fix this problem...

[jokke]

A quick search showed up one possible way of fixing this that requires you to completely delete the swprv service before reinstalling the COM+ catalog one more time;

With all these problems, you would hae been better off creating a vm from scratch... instead of p2v'ing. Or at least coldclone your machine...

[lensv]

He he, as you probably know it is pretty hard to give up troubleshooting once you've started... And starting from scratch is not an option here (the physical machine has softwares installed that aren't available anymore).

I shall take a look at your link as soon as I find some time...

[jokke]

Another solution that may work, is to install a trial of ShadowProtect and make a backup image of your system. Then converter version 4 will be able to import this image and convert it to a vm.

But I don't know if ShadowProtect will be able to make such a backup image of your damaged system.... Maybe worth a try, and you could uninstall the trial software afterwards.

[lensv]

Hmm...

Looking at your last link makes me realize that the MS Software Shadow Copy Provider doesn't even exist among the COM+ applications in the Component Services window (point 3 in the instructions). Is there a way to manually add it?

[jokke]

Maybe, I did something similar a while ago. If you have another machine with swprv correctly installed. Open the component services on that machine and export swprv to a msi file. Copy it over to the troublesome machine and import it.... fingers crossed.

[lensv]

That's it! Now all services starts without any kind of trouble and no errors appears in the event logs :smileyhappy:

What remains to be seen now is if VMware Converter will work alright... I'll be back!

[lensv]

Alright! This time it worked. I had a couple of smaller issues with bad blocks on disk, but the cloning went through... :smileyhappy:

Special thanks to Jokke, who helped me out here!

[jokke]

It was an interesting journey with lots of bugs there. Good to hear you did it and good luck virtualizing. :smileyhappy:

[jokke]

Don't run;

"sc create SwPrv binpath= "C:\WINDOWS\system32\dllhost.exe

/Processid:{C6FCFDE0-EF33-4F90-B355-9F1F7E89753E}" depend= rpcss

DisplayName= "MS Software Shadow Copy Provider""

Try "sc start comsysapp"

[jokke]

Lets just hope COM+ (comsysapp) was disabled instead of a broken COM+ catalog.

[jokke]

Anyways, if it's not installed;

"sc create SwPrv binpath= "C:\WINDOWS\system32\dllhost.exe /Processid:{C6FCFDE0-EF33-4F90-B355-9F1F7E89753E}" depend= rpcss DisplayName= "MS Software Shadow Copy Provider""

Joakim

[edooze1]

This fixed my issue, over 3 years later. Wanted to reply in case anyone else is suffering the same issue. Thanks.

[jokke]

Maybe try coldcloning with version 3.x.

Maybe you have a backup image of your system in one of the supported 3rd party image formats. If so, you can import this image into converter and convert it to a vm.

Joakim

[jokke]

One more thing;

Can you verify that your wmi service is running ok?