Error making image in Windows 10

Topic

New Reply

No problem making system image in Windows 7. Tried in my new windows 10 environment and failed. Following error message:

Windows Backup failed to create the shared protection point on the source volumes. (0x8078006B)

Additional Information: The shadow copy provider had an unexpected error while trying to process the specified operation. (0x8004230F)

I then tried to set a restore point manually and got this error message, tied to the system property tab of some window: There was an unexpected error in the property page: System Restore encountered an error. Please try to run System Restore Again (0x81000203)

On this tab there is a place to show “available drives” and it got stuck on ‘searching’, never displayed any.

Retry produced the same result.

Any ideas how to get system image to work, given this information?

Reply | Quote

Replies

Seems you have a problem with the VSS system. I’d check Event Viewer for errors, or use NirSoft FullEventLogViewer.

Post details of errors an we will advise.

cheers, Paul

Reply | Quote

Indeed there are errors and I will post below. However, this may help also. I tried to run checkdisk on my I drive and C drive and got error message that it couldn’t. Said to run check and repair, which I did the the I drive and it said it cleaned it up. Report  below here. Said to do the same thing with C drive, but that made me too nervous, so don’t know if it’s ok to do that. I have not done that.

This is re trying to set restore point, which it couldn’t do. Then tried to run checkdisk, with this result:”There was a problem scanning this drive. Windows was unable to scan the drive. Close this dialog box, and then try to scan the drive again. If the problem persists, scan and

When I went to details, I got the following information.”Checking file system on I: The shadow copy provider had an unexpected error while trying to process the specified operation. A snapshot error occured while scanning this drive. You can try atain, but if this problem persists run an offline scan and fix.

So I followed suggestion to “scan and repair”, which it reported success with: “Your drive was successfully scanned. Windows successfully scanned the drive. No errors were found.

I went to details and copied the report, see below.

Log Name:      Application
Source:        Chkdsk
Date:          3/3/2020 4:03:38 PM
Event ID:      26214
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      Ellen-PC
Description:
Chkdsk was executed in read/write mode.

Checking file system on I:
Volume label is Seagate Expansion Drive.

Stage 1: Examining basic file system structure …
256 file records processed.
File verification completed.
0 large file records processed.
0 bad file records processed.

Stage 2: Examining file name linkage …
1 reparse records processed.
342 index entries processed.
Index verification completed

1 reparse records processed.

Stage 3: Examining security descriptors …
Cleaning up 5 unused index entries from index $SII of file 0x9.
Cleaning up 5 unused index entries from index $SDH of file 0x9.
Cleaning up 5 unused security descriptors.
Security descriptor verification completed.
43 data files processed.

Windows has scanned the file system and found no problems.
No further action is required.

1953512032 KB total disk space.
227461792 KB in 73 files.
100 KB in 45 indexes.
125820 KB in use by the system.
1725924320 KB available on disk.

4096 bytes in each allocation unit.
488378008 total allocation units on disk.
431481080 allocation units available on disk.

Event Xml:

<Event xmlns=”http://schemas.microsoft.com/win/2004/08/events/event”&gt;
<System>
<Provider Name=”Chkdsk” />
<EventID Qualifiers=”0″>26214</EventID>
<Level>4</Level>
<Task>0</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime=”2020-03-03T22:03:38.589798500Z” />
<EventRecordID>5188</EventRecordID>
<Channel>Application</Channel>
<Computer>Ellen-PC</Computer><Security />
</System>
<EventData>
<Data>

Checking file system on I:
Volume label is Seagate Expansion Drive.

Stage 1: Examining basic file system structure …
256 file records processed.
File verification completed.
0 large file records processed.
0 bad file records processed.

Stage 2: Examining file name linkage …
1 reparse records processed.
342 index entries processed.
Index verification completed.

1 reparse records processed.

Stage 3: Examining security descriptors …
Cleaning up 5 unused index entries from index $SII of file 0x9.
Cleaning up 5 unused index entries from index $SDH of file 0x9.
Cleaning up 5 unused security descriptors.
Security descriptor verification completed.
43 data files processed.

Windows has scanned the file system and found no problems.
No further action is required.

1953512032 KB total disk space.
227461792 KB in 73 files.
100 KB in 45 indexes.
125820 KB in use by the system.
65536 KB occupied by the log file.
1725924320 KB available on disk.

4096 bytes in each allocation unit.
488378008 total allocation units on disk.
431481080 allocation units available on disk.
</Data>
<Binary>0001000081000000A80000000000000001000000000000000000000000000000</Binary>
</EventData>
</Event>
E  N  D

Now back to the suggestion re event log. Here is the report on VSS –looks like it logged this 24 times.

Volume Shadow Copy Service information: The COM Server with CLSID {4e14fba2-2e22-11d1-9964-00c04fbbb345} and name CEventSystem cannot be started. [0x8007045b, A system shutdown is in progress.
]
Log Name: Application
Source: VSS
Date: 3/1/2020 9:28:42 AM
Event ID: 13
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: Ellen-PC
Description:
Volume Shadow Copy Service information: The COM Server with CLSID {4e14fba2-2e22-11d1-9964-00c04fbbb345} and name CEventSystem cannot be started. [0x8007045b, A system shutdown is in progress.
]
Event Xml:
<Event xmlns=”http://schemas.microsoft.com/win/2004/08/events/event”&gt;
<System>
<Provider Name=”VSS” />
<EventID Qualifiers=”0″>13</EventID>
<Level>2</Level>
<Task>0</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime=”2020-03-01T15:28:42.771236800Z” />
<EventRecordID>4868</EventRecordID>
<Channel>Application</Channel>
<Computer>Ellen-PC</Computer>
<Security />
</System>
<EventData>
<Data>{4e14fba2-2e22-11d1-9964-00c04fbbb345}</Data>
<Data>CEventSystem</Data>
<Data>0x8007045b, A system shutdown is in progress.
</Data>
<Data>
</Data>
<Binary>2D20436F64653A20575254575254494330303030343932332D2043616C6C3A20575254575254494330303030343931362D205049443A202030303030343038342D205449443A202030303030373639362D20434D443A2020433A5C57494E444F57535C73797374656D33325C76737376632E6578652020202D20557365723A204E616D653A204E5420415554484F524954595C53595354454D2C205349443A532D312D352D313820</Binary>
</EventData>
</Event>

I have several other errors also, which I will show here.

this one shows 31 times

Log Name: Microsoft-Windows-Kernel-EventTracing/Admin
Source: Microsoft-Windows-Kernel-EventTracing
Date: 3/4/2020 10:01:07 AM
Event ID: 2
Task Category: Session
Level: Error
Keywords: Session
User: SYSTEM
Computer: Ellen-PC
Description:
Session “PerfDiag Logger” failed to start with the following error: 0xC0000035
Event Xml:
<Event xmlns=”http://schemas.microsoft.com/win/2004/08/events/event”&gt;
<System>
<Provider Name=”Microsoft-Windows-Kernel-EventTracing” Guid=”{b675ec37-bdb6-4648-bc92-f3fdc74d3ca2}” />
<EventID>2</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>2</Task>
<Opcode>12</Opcode>
<Keywords>0x8000000000000010</Keywords>
<TimeCreated SystemTime=”2020-03-04T16:01:07.253200900Z” />
<EventRecordID>175</EventRecordID>
<Correlation />
<Execution ProcessID=”4″ ThreadID=”2944″ />
<Channel>Microsoft-Windows-Kernel-EventTracing/Admin</Channel>
<Computer>Ellen-PC</Computer>
<Security UserID=”S-1-5-18″ />
</System>
<EventData>
<Data Name=”SessionName”>PerfDiag Logger</Data>
<Data Name=”FileName”>
</Data>
<Data Name=”ErrorCode”>3221225525</Data>
<Data Name=”LoggingMode”>8388736</Data>
</EventData>
</Event>

This one shows 73 times

Log Name: Microsoft-Windows-Kernel-EventTracing/Admin
Source: Microsoft-Windows-Kernel-EventTracing
Date: 3/4/2020 10:43:01 AM
Event ID: 3
Task Category: Session
Level: Error
Keywords: Session
User: SYSTEM
Computer: Ellen-PC
Description:
Session “PerfDiag Logger” stopped due to the following error: 0xC0000188
Event Xml:
<Event xmlns=”http://schemas.microsoft.com/win/2004/08/events/event”&gt;
<System>
<Provider Name=”Microsoft-Windows-Kernel-EventTracing” Guid=”{b675ec37-bdb6-4648-bc92-f3fdc74d3ca2}” />
<EventID>3</EventID>
<Version>1</Version>
<Level>2</Level>
<Task>2</Task>
<Opcode>14</Opcode>
<Keywords>0x8000000000000010</Keywords>
<TimeCreated SystemTime=”2020-03-04T16:43:01.544315500Z” />
<EventRecordID>177</EventRecordID>
<Correlation />
<Execution ProcessID=”4″ ThreadID=”14248″ />
<Channel>Microsoft-Windows-Kernel-EventTracing/Admin</Channel>
<Computer>Ellen-PC</Computer>
<Security UserID=”S-1-5-18″ />
</System>
<EventData>
<Data Name=”SessionName”>PerfDiag Logger</Data>
<Data Name=”FileName”>C:\WINDOWS\system32\WDI\LogFiles\ShutdownPerfDiagLogger.etl</Data>
<Data Name=”ErrorCode”>3221225864</Data>
<Data Name=”LoggingMode”>41943168</Data>
<Data Name=”FailureReason”>0</Data>

Log Name: Application
Source: ESENT
Date: 3/4/2020 10:47:53 AM
Event ID: 455
Task Category: Logging/Recovery
Level: Error
Keywords: Classic
User: N/A
Computer: Ellen-PC
Description:
svchost (7752,R,98) TILEREPOSITORYS-1-5-18: Error -1023 (0xfffffc01) occurred while opening logfile C:\WINDOWS\system32\config\systemprofile\AppData\Local\TileDataLayer\Database\EDB.log.
Event Xml:
<Event xmlns=”http://schemas.microsoft.com/win/2004/08/events/event”&gt;
<System>
<Provider Name=”ESENT” />
<EventID Qualifiers=”0″>455</EventID>
<Level>2</Level>
<Task>3</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime=”2020-03-04T16:47:53.715396500Z” />
<EventRecordID>5243</EventRecordID>
<Channel>Application</Channel>
<Computer>Ellen-PC</Computer>
<Security />
</System>
<EventData>
<Data>svchost</Data>
<Data>7752,R,98</Data>
<Data>TILEREPOSITORYS-1-5-18: </Data>
<Data>C:\WINDOWS\system32\config\systemprofile\AppData\Local\TileDataLayer\Database\EDB.log</Data>
<Data>-1023 (0xfffffc01)</Data>
</EventData>
</Event>

Also this one

Log Name: Microsoft-Windows-Dhcpv6-Client/Admin
Source: Microsoft-Windows-DHCPv6-Client
Date: 3/3/2020 1:01:50 PM
Event ID: 1000
Task Category: Address Configuration State Event
Level: Error
Keywords:
User: LOCAL SERVICE
Computer: Ellen-PC
Description:
Your computer has lost the lease to its IP address 2600:1700:8660:efe0::49 on the Network Card with network address 0x90B11C7C2724.
Event Xml:
<Event xmlns=”http://schemas.microsoft.com/win/2004/08/events/event”&gt;
<System>
<Provider Name=”Microsoft-Windows-DHCPv6-Client” Guid=”{6a1f2b00-6a90-4c38-95a5-5cab3b056778}” />
<EventID>1000</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>3</Task>
<Opcode>72</Opcode>
<Keywords>0x8000000000000000</Keywords>
<TimeCreated SystemTime=”2020-03-03T19:01:50.148275400Z” />
<EventRecordID>240</EventRecordID>
<Correlation />
<Execution ProcessID=”1776″ ThreadID=”9536″ />
<Channel>Microsoft-Windows-Dhcpv6-Client/Admin</Channel>
<Computer>Ellen-PC</Computer>
<Security UserID=”S-1-5-19″ />
</System>
<EventData>
<Data Name=”InterfaceGUID”>2600:1700:8660:efe0::49</Data>
<Data Name=”HWLength”>6</Data>
<Data Name=”HWAddress”>90B11C7C2724</Data>
</EventData>
</Event>

</EventData>
</Event>

Log Name: Microsoft-Windows-Kernel-EventTracing/Admin
Source: Microsoft-Windows-Kernel-EventTracing
Date: 3/4/2020 10:43:01 AM
Event ID: 3
Task Category: Session
Level: Error
Keywords: Session
User: SYSTEM
Computer: Ellen-PC
Description:
Session “PerfDiag Logger” stopped due to the following error: 0xC0000188
Event Xml:
<Event xmlns=”http://schemas.microsoft.com/win/2004/08/events/event”&gt;
<System>
<Provider Name=”Microsoft-Windows-Kernel-EventTracing” Guid=”{b675ec37-bdb6-4648-bc92-f3fdc74d3ca2}” />
<EventID>3</EventID>
<Version>1</Version>
<Level>2</Level>
<Task>2</Task>
<Opcode>14</Opcode>
<Keywords>0x8000000000000010</Keywords>
<TimeCreated SystemTime=”2020-03-04T16:43:01.544315500Z” />
<EventRecordID>177</EventRecordID>
<Correlation />
<Execution ProcessID=”4″ ThreadID=”14248″ />
<Channel>Microsoft-Windows-Kernel-EventTracing/Admin</Channel>
<Computer>Ellen-PC</Computer>
<Security UserID=”S-1-5-18″ />
</System>
<EventData>
<Data Name=”SessionName”>PerfDiag Logger</Data>
<Data Name=”FileName”>C:\WINDOWS\system32\WDI\LogFiles\ShutdownPerfDiagLogger.etl</Data>
<Data Name=”ErrorCode”>3221225864</Data>
<Data Name=”LoggingMode”>41943168</Data>
<Data Name=”FailureReason”>0</Data>
</EventData>
</Event>

 

IS IT TIME FOR ME TO HAVE A SERVICE CALL WITH THE FOLKS WHO INSTALLED WINDOWS 10 for me?

I am flabergasted to see all these errors, because otherwise the computer seems to be behaving quite nicely.

Thanks,
Ellen

Reply | Quote

Those errors are standard (scammers persuade people to part with money by showing those sorts of errors).

I would also run DISM and SFC to be sure everything is happy, then try the image again.

1. Open a Command Prompt as admin.
2. Type: dism /online /cleanup-image /restorehealth
3. Type: sfc /scannow

cheers, Paul

Reply | Quote

Well,
Neither of those worked. I called in my computer pros, and they determined that there was something deep in the registry associated with the upgrade. They took my computer away and did a fresh install of windows 10 rather than upgrade from 7, and I can now make images and restore points.
Thanks for your suggestions.
Ellen

Reply | Quote