🖥️
Windows DFIR
  • Introduction
  • Windows Artifacts
    • Windows Quick Tips
      • Windows Command Line
      • Workstation File/Folder Locations
      • Server File/Folder Locations
    • Account Usage
      • Authentications SAM Artifacts
        • Last Login
        • Last Failed Login
        • Last Password Change
      • Authentications (Windows Event Log)
        • Logon ID
      • Group Membership
        • Event ID: 4798
        • Event ID: 4799
      • RDP
        • Source System Artifacts - Quick Reference
        • Destination System Artifacts - Quick Reference
      • SSH
      • Rouge Local Accounts
      • CrowdStrike Searches
        • Event Name - UserLogon
        • Event Name - UserLogonFailed
        • Event Name - UserLogonFailed2
        • Event Name - SsoApplicationAccess
    • Browser Usage
      • History & Downloads
        • Viewing History Files - DB Browser
        • Transition Types
      • Auto-Complete Data
      • Bookmarks
      • Browser Preferences
      • Cache
      • Cookies
      • Extensions
      • Super Cookies (HTML5 Web Storage)
      • Media History
      • Private Browsing
      • Session Restore
      • Stored Credentials
      • Suggested/Frequent Sites
      • DB Browser Queries
        • Firefox
        • Chrome
        • Media History
      • PowerShell Scripts
        • Browser Extension Finder
        • Browser History Finder
    • Processes
      • at.exe
      • explorer.exe
      • lsass.exe
      • lsaiso.exe
      • PuTTy.exe
        • X11 Forwarding
      • runtimebroker.exe
      • services.exe
      • smss.exe
      • System
      • svchost.exe
        • Services
      • winlogon.exe
      • wininit.exe
    • Cloud Storage
    • Deleted File or File Knowledge
      • WordWheelQuery (Win 7+)
      • ACMRU (Win XP)
      • Internet Explorer file:///
      • Last Visited MRU
      • Thumbs.db (Win XP)
      • Thumbcache
      • Recycle Bin
      • User Typed Paths
      • Windows Search Database
    • File Download
      • Zone.Identifer
      • Open/Save Most Recently Used (MRU)
      • Email
      • Drive By Downloads
        • Malvertising
      • Web Browsing
        • Cache Files
      • CrowdStrike Searches
        • MoTW
    • Folder/File Opening/Creation
      • Recent Files
      • Office Recent Files
      • Shell Bags
      • .lnk Files
      • Jump Lists
        • AppIDs
      • Prefetch
      • Index.dat file://
      • PowerShell Scripts
        • .lnk Files
    • Persistence
      • Registry
        • NTUSER.DAT & HKU\SID
        • Run and Run Once
        • Shell Folders and UserInit Key
        • Services
        • Logon Scripts
        • Office Add-ins
        • Winlogon Shell
        • Image File Execution Options (IFEO)
        • AppInit_DLLs
        • Scheduled Tasks
      • Scheduled Tasks
        • Scheduled Task Destination System Artifacts
        • Scheduled Task Source System Artifacts
      • Startup
      • Tool: AutoRuns
      • Accounts
      • WMI Event Consumers
        • WMI: Source System Artifacts
        • WMI: Destination System Artifacts
        • WMI: PowerShell Analysis
      • PowerShell Scripts
        • Startup Programs
      • CrowdStrike Searches
        • Files Written to Startup Folder
        • Files Written to Startup Folder from the Internet
        • Local Account Creation/Deletion
        • Azure Account Creation/Deletion
        • Scheduled Tasks
    • Physical Location
      • Time zone
      • Wireless SSID
      • Network History (Vista/Win7–11)
      • Cookies
      • Browser Search Terms
    • Program Execution
      • Prefetch
        • Decoding Prefetch Files with Eric Zimmerman's PECmd Tool
      • BAM/DAM
      • CapabilityAccessManager
      • UserAssist
      • Last Visited MRU
      • RunMRU
      • MUI Cache
      • ShimCache
      • Amcache
      • Jump Lists
    • Shadow Copies
      • VSC Permissions
      • Event ID 8193: Volume Shadow Copy Service Error
    • USB Usage
      • Key Identification
      • Drive Letter and Volume Name
      • Connection Timestamps
      • User
      • Volume Name
      • Plug & Play Event Log
    • Windows Services
      • DoSvc (Delivery Optimization)
    • System Information
    • Event IDs
      • Authentication / Account
        • 4624 - Authentication Success
          • Logon Types
        • 4625 - Authentication Failure
          • SubStatus Codes
        • 4634 - Account Logoff
        • 4648 - Explicit Credentials Success
        • 4672 - Special Privileges
        • 4720 - Account Creation
        • 4722 - Account Enabled
        • 4732 - Addition to Local Group
        • 4738 - Account Changed
        • 4776 - Kerberos Authentication Attempt
          • Substatus Codes
        • 4771 - Kerberos Failure
        • 4768
      • File System
        • 1006
        • 4688 - Process Created
        • 4663
        • 4656
        • 6416
        • 20001
        • 20003
  • Windows DFIR & MITTR
    • Initial Access
      • Content Injection
      • Drive-by Compromise
        • Watering Hole Attack
        • Microsoft Files (Payload Execution)
        • Exploit Delivery
        • Viewing Browser History Files
      • Phishing
    • Execution
    • Persistence
    • Privilege Escalation
    • Defense Evasion
    • Credential Access
      • Logon ID
    • Discovery
    • Lateral Movement
    • Collection
    • Command and Control
    • Exfiltration
    • Impact
  • SOC Related
    • Cached Credentials
    • Domain Controller Password Spraying
Powered by GitBook
On this page

Was this helpful?

  1. Windows Artifacts
  2. Shadow Copies

Event ID 8193: Volume Shadow Copy Service Error

eventlog view Application 100 VSS
Index    Time          EntryType   Source   InstanceID  Message
-----    ----          ---------   ------   ----------  -------
5981     Apr 26 19:16  Error       VSS      8193                 
               
Volume Shadow Copy Service error: Unexpected error calling routine QueryFullProcessImageNameW.  hr= 0x80070006, The handle is invalid.
Operation:
Executing Asynchronous Operation
Context:
Current State: DoSnapshotSet

Volume Shadow Copy Service, also known as Volume Snapshot Service or VSS, is an inbuilt utility in Windows that allows you to create backup snapshots or copies of computer files/volumes whether you are in use or not. When your files are lost or the system is crashed, you can use it to restore them.

However, when Volume Shadow Copy Service is incapable of completing a backup or restore operation, you will receive Event ID 8193 in Event Viewer. The complete error message is: Event ID: 8193. Volume Shadow Copy Service error: Unexpected error calling routine. Access is denied.

Many factors can contribute to VSS error 8193 Windows 10. Here are some possible culprits:

  • Volume Shadow Copy Service is disabled.

  • The Network Service account is disabled and System Writer is initialized.

  • Other applications that use Volume Shadow Copy Service interfere with the process.

  • Some components of Volume Shadow Copy Service are missing or corrupted.

  • The disk space is insufficient.

Check to see if the service is enabled, disabled, or set to manual.

(Get-Service -Name "VSS").StartType
  • Automatic: The service starts automatically when the computer boots up.

  • Manual: The service does not start automatically when the computer boots up. You must manually start the service.

  • Disabled: The service is disabled and cannot be started.

The error code 0x80070006 means "The handle is invalid." This error occurs when the Volume Shadow Copy Service (VSS) tries to access a process that does not exist or that is not running.

The error message "Unexpected error calling routine QueryFullProcessImageNameW" means that VSS was unable to get the name of the process that it was trying to access. This can happen if the process is not running or if the VSS service does not have the permissions to access the process.

If you see this error message, you can try restarting the VSS service. You can also check the permissions for the VSS service to make sure that it has the permissions to access the process.

Here are some possible causes of the error code 0x80070006:

  • The process that VSS is trying to access does not exist.

  • The process that VSS is trying to access is not running.

  • The VSS service does not have the permissions to access the process.

  • There is a problem with the VSS service itself.

PreviousVSC PermissionsNextUSB Usage

Last updated 1 year ago

Was this helpful?

https://www.minitool.com/backup-tips/event-id-8193.html