Privacy policy. The Volume Shadow Copy Service VSS is a set of COM interfaces that implements a framework to allow volume backups to be performed while applications on a system continue to write to the volumes. For information about run-time requirements for a particular programming element, see the Requirements section of the documentation for that element. All bit VSS applications requesters, providers, and writers must run as native bit or bit applications.
Running them under WOW64 is not supported. For more information, see Supported Configurations and Restrictions. Support for running bit requesters under WOW64 was removed in Windows Vista and subsequent versions. And Microsoft promises to update the CVE as the investigation progresses. They added the affected versions of Windows in the Security Updates tab and provides 2 available methods to fix this issue. Below is the outline of them:. Check if your computer is affected.
Then, if your computer is affected, check if there are any shadow copies on your computer. Type vssadmin list shadows and hit Enter. Block unprivileged users from accessing to sensitive registry files. You can use cmd or powershell. If there are any other partitions or volumes, please repeat this command and replace C: with other drive letters, D:, E:,for example. Check if there are still copyies left.
Type vssadmin list shadows command and hit Enter. If all of them are deleted, you will get response "No items found that satisfy the query" from command prompt.
Step 6. Restart your computer and create a system restor point in the System Properties window. After these changes made, the newly created shadow copies should have the read-write permissions. Also, you can check if your computer is affected again using icacls command. With which, you can not only enjoy the advantages of VSS, but also overcome its problem, such as, the shadow copy may be deleted due to Volume Shadow Copy Windows 10 high disk usage, etc.
For advanced users, you can use its professional version. It is able to delete old backup images with Backup Scheme, restore Windows backup to dissimilar hardware , for example, different CPU, with Universal Restore, etc. Can't afford data loss? Please download this software and create a backup just in case. Content of this article: What is Volume Shadow Copy? Click Create to enable volume shadow copy in Windows Select the correct version of file or folder to restore.
How to easily backup files and folders in Windows 10 with VSS As mentioned earlier, the volume shadow copy does help to backup files or volumes and you need to make use of a trust and reliable backup software like AOMEI Backupper Standard. It can backup files in partitions with other file systems, and also make up for its other shortcomings.
Also, you can directly remove unprivileged users from SAM, Security, System by the following command prompt. Remember to hit Enter after each one. At this point applications are free to resume writing data to the disk that is being shadow-copied. The shadow copy creation can be aborted if the writers are kept in the freeze state for longer than 60 seconds or if the providers take longer than 10 seconds to commit the shadow copy.
The requester can retry the process go back to step 1 or notify the administrator to retry at a later time. If the shadow copy is successfully created, the Volume Shadow Copy Service returns the location information for the shadow copy to the requester. In some cases, the shadow copy can be temporarily made available as a read-write volume so that VSS and one or more applications can alter the contents of the shadow copy before the shadow copy is finished.
After VSS and the applications make their alterations, the shadow copy is made read-only. This phase is called Auto-recovery, and it is used to undo any file-system or application transactions on the shadow copy volume that were not completed before the shadow copy was created. A hardware or software shadow copy provider uses one of the following methods for creating a shadow copy:.
Complete copy This method makes a complete copy called a "full copy" or "clone" of the original volume at a given point in time. This copy is read-only. Copy-on-write This method does not copy the original volume. Redirect-on-write This method does not copy the original volume, and it does not make any changes to the original volume after a given point in time. Instead, it makes a differential copy by redirecting all changes to a different volume. After the mirror connection is broken, the original volume and the shadow copy volume are independent.
The shadow copy storage area can be on the same volume or a different volume. This preserves a copy of the data block on the original volume before the change overwrites it. The copy-on-write method is a quick method for creating a shadow copy, because it copies only data that is changed. The copied blocks in the diff area can be combined with the changed data on the original volume to restore the volume to its state before any of the changes were made. If there are many changes, the copy-on-write method can become expensive.
Instead, the change is written to another volume's shadow copy storage area. Like the copy-on-write method, the redirect-on-write method is a quick method for creating a shadow copy, because it copies only changes to the data. The copied blocks in the diff area can be combined with the unchanged data on the original volume to create a complete, up-to-date copy of the data. There are two types of shadow copy providers: hardware-based providers and software-based providers.
There is also a system provider, which is a software provider that is built in to the Windows operating system. Hardware-based shadow copy providers act as an interface between the Volume Shadow Copy Service and the hardware level by working in conjunction with a hardware storage adapter or controller. The work of creating and maintaining the shadow copy is performed by the storage array.
Hardware providers always take the shadow copy of an entire LUN, but the Volume Shadow Copy Service only exposes the shadow copy of the volume or volumes that were requested. A hardware-based shadow copy provider makes use of the Volume Shadow Copy Service functionality that defines the point in time, allows data synchronization, manages the shadow copy, and provides a common interface with backup applications.
However, the Volume Shadow Copy Service does not specify the underlying mechanism by which the hardware-based provider produces and maintains shadow copies. These providers are implemented as a user-mode DLL component and at least one kernel-mode device driver, typically a storage filter driver.
Unlike hardware-based providers, software-based providers create shadow copies at the software level, not the hardware level. A software-based shadow copy provider must maintain a "point-in-time" view of a volume by having access to a data set that can be used to re-create volume status before the shadow copy creation time.
An example is the copy-on-write technique of the system provider. However, the Volume Shadow Copy Service places no restrictions on what technique the software-based providers use to create and maintain shadow copies. A software provider is applicable to a wider range of storage platforms than a hardware-based provider, and it should work with basic disks or logical volumes equally well. A logical volume is a volume that is created by combining free space from two or more disks.
In contrast to hardware shadow copies, software providers consume operating system resources to maintain the shadow copy. One shadow copy provider, the system provider, is supplied in the Windows operating system. Although a default provider is supplied in Windows, other vendors are free to supply implementations that are optimized for their storage hardware and software applications. To maintain the "point-in-time" view of a volume that is contained in a shadow copy, the system provider uses a copy-on-write technique.
Copies of the blocks on volume that have been modified since the beginning of the shadow copy creation are stored in a shadow copy storage area. The system provider can expose the production volume, which can be written to and read from normally. When the shadow copy is needed, it logically applies the differences to data on the production volume to expose the complete shadow copy. For the system provider, the shadow copy storage area must be on an NTFS volume.
The Windows operating system includes a set of VSS writers that are responsible for enumerating the data that is required by various Windows features. In addition to backing up application data and system state information, shadow copies can be used for a number of purposes, including the following:.
This is a fast-recovery scheme that allows an application administrator to restore data from a shadow copy to the original LUN or to a new LUN.
The shadow copy can be a full clone or a differential shadow copy. In either case, at the end of the resync operation, the destination LUN will have the same contents as the shadow copy LUN. During the resync operation, the array performs a block-level copy from the shadow copy to the destination LUN. While the resync operation is in progress, read requests are redirected to the shadow copy LUN, and write requests to the destination LUN.
This allows arrays to recover very large data sets and resume normal operations in several seconds. In a LUN swap, the shadow copy is imported and then converted into a read-write volume.
In LUN resynchronization, the shadow copy is not altered, so it can be used several times. In LUN swapping, the shadow copy can be used only once for a recovery. For the most safety-conscious administrators, this is important. When LUN resynchronization is used, the requester can retry the entire restore operation if something goes wrong the first time.
0コメント