SIRIS, ALTO, and NAS: Manually Removing the AAVolFlt Driver



This article explains the process for manually removing the AAVolFlt after an AppAssure uninstallation. 


The content of this article is provided by Quest Software, the publisher of the application, and involves modifying the Windows Registry. Be sure to back up the registry before making any modifications to it.

This Microsoft Support article explains how to back up the Windows registry. 


First, remove AAVolFlt as an upper filter for the device classes where it is specified. This is the critical part to get right, as the system will be unbootable if AAVolFlt remains an upper filter for a required device class, but the driver does not load.

There are three device classes for which AAVolFlt might be listed as an upper filter: Storage Volumes, Storage Volume Shadow Copies and Disk Drives. The keys for the device classes are under the registry key HKLM\System\CurrentControlSet\Control\Class and are named based on the GUID associated with the device class.  These GUIDs are:

    • Storage Volumes: {71A27CDD-812A-11D0-BEC7-08002BE2092F}
    • Storage Volume Shadow Copies: {533C5B84-EC70-11D2-9505-00C04F79DEAF}
    • Disks: {4D36E967-E325-11CE-BFC1-08002BE10318}

Underneath each of these GUID named keys, there may be a multi-string typed value named “UpperFilters”.  If the UpperFilters value does not exist, or does not contain the string “AAVolFlt”, do nothing.  If AAVolFlt is the only driver listed, delete the UpperFilters value.  If AAVolFlt and any other driver(s) are listed, edit the UpperFilters value and remove only the AAVolFlt string.

Next delete the services registry keys for AAFsFlt, AAVdisk, AAVolFlt and AAVStor.  These are located under HKLM\System\CurrentControlSetServices.  Expand that registry key and right-click Delete the registry key for each of the AppAssure drivers that have an entry.


Reboot after modifying the registry, but before deleting any files.  That way, if the system is unbootable due to errors in the first step, you should be able to boot the “Last known good” configuration.

Delete Driver Binaries

After a successful reboot you can safely deleted the driver binaries if they exist.  The file specifications to delete are:

    • C:\Windows\System32\Drivers\AAFsFlt.sys
    • C:\Windows\System32\Drivers\AAVolFlt.sys
    • C:\Windows\System32\Drivers\AAVDisk.sys
    • C:\Windows\System32\Drivers\AAVStor.sys

Delete Metadata Files

The drivers metadata files are located in the \System Volume Information on each volume on the system.  That folder is not accessible to administrators by default, so it is necessary to modify the ACL to delete the files.

Deleting the and files is optional.  They take almost no space, and if the product is going to be reinstalled, it may be desirable to keep the metadata.  Deleting the log files is more important.  They will be invalid after removal of the product, and under some circumstances, may be quite large.  To delete the log files, grant Administrators group full access to the \System Volume Information folder, and delete an files of the form AALog_{}_.log.  

Was this article helpful?

0 out of 0 found this helpful

You must sign in before voting on this article.

Want to talk about it? Have a feature request?

Head on over to our Datto Community Forum or the Datto Community Online.

For more Business Management resources, see the Datto RMM Online Help and the Autotask PSA Online Help .

Still have questions? Get live help.

Datto Homepage