This article discusses disabling and purging Microsoft Shadow Copies when protecting Windows servers.
- Datto SIRIS
- Datto ALTO
Shadow Copy (also known as Volume Snapshot Service, Volume Shadow Copy Service or VSS) is a technology included in Microsoft Windows that can take manual or automatic backups of computer files and volumes, even when they are in use. It runs as a Windows service named Volume Shadow Copy.
Components that use this service include Windows Backup and System Restore, but any Windows component that uses Volume Shadow Copy's VSS provider service can create Shadow Copies.
This article details how to disable and remove Shadow Copies.
Shadow Copies and the Datto solution
Shadow Copies present on a system protected by a Datto device can throw off incremental counters, cause conflicts, and fill storage space backups need in order to run. To avoid conflicts, you must:
- purge any orphaned Shadow Copies from your protected machine and disable the service.
- make sure that any other backup solutions are uninstalled from the protected system, as they can cause conflicts and failures with our backup solution.
- Microsoft Windows Server 2003 & 2008/R2
- Microsoft Windows Server 2012
- Microsoft Windows Workstations
- Legacy Windows: Microsoft Windows Server 2003 & Windows XP (NTBackup)
- Removing Shadow Copies through an elevated command prompt
1. Open Windows Explorer or the Microsoft Management Console (MMC) Disk Management snap-in, and then right-click the drive.
2. Select Properties from the context menu.
3. Select the Shadow Copies tab.
4. Highlight each volume being backed up, and select Disable.
If there are any Shadow Copies under the Shadow Copies of selected volume section, click Delete Now. Make sure that no Shadow Copies remain.
You can also use an elevated command prompt to confirm that the Shadow Copies were removed.
1. Open File Explorer, and right-click the volume that you want to disable Volume Shadow Copies on. Select Configure Shadow Copies.
2. Select the volume and click Disable. Then, click Delete Now.
1. From the Windows Start Menu, navigate to Control Panel, and then click System and Maintenance, System and Security, or System.
2. Click System → System Protection.
Figure 4: System protection (click to enlarge)
3. To disable Volume Shadow Copy, uncheck the box next to each volume you want to exclude, as shown in Figure 5. For Windows 8 and Windows 10, you might need to click Configure, followed by Disable system protection for each volume, as shown in Figure 6.
4. A dialog box will appear asking if you are sure you want to turn off System Restore. Click the Turn System Restore off button or the Yes button. Then, click OK.
NTBackup is a built-in backup application that was bundled with all versions of Windows, beginning with Windows NT and ending with Windows Server 2003. Windows Backup replaced it when Windows Vista was released. To remove jobs from NTBackup, follow these steps:
1. From the Run prompt, type ntbackup. You can also access the application from the Start menu, by clicking Start → All Programs → Accessories → System Tools → Backup.
2. If NTBackup launches in Wizard Mode, switch to Advanced Mode by unchecking the Always Start in Wizard Mode check box. Then, click Advanced Mode → Schedule Jobs.
3. Right-click the tasks that you want to remove, and then click Delete. You can also remove the task by navigating to Start → Settings → Control Panel → Scheduled Tasks.
4. If removing the tasks does not stop NTBackup from running, you can navigate to %SystemDrive%\Windows\System32\ntbac
You can remove Shadow Copies from a host system from an elevated Command Prompt session. After disabling Shadow Copies through Windows, launch a Command Prompt with Administrator privileges, and run the
vssadmin list shadows command. If no Shadow Copies are present, you will see the output shown in Figure 8.
1. To remove Shadow Copies for a specific drive, run the
Vssadmin delete shadows /For=:<driveletter> /all command. Replace <driveletter> with the letter of the system volume you want to remove the Shadow Copies from, as shown in the below example.
Microsoft Windows [Version 10.0.10586] (c) 2015 Microsoft Corporation. All rights reserved. C:\Windows\system32>vssadmin delete shadows /For=C: /oldest vssadmin 1.1 - Volume Shadow Copy Service administrative command-line tool (C) Copyright 2001-2013 Microsoft Corp. Do you really want to delete 1 shadow copies (Y/N): [N]? y Successfully deleted 1 shadow copies. C:\Windows\system32>
2. To remove all Shadow Copies from all volumes, run
vssadmin delete shadows /all from the command line.
3. If this fails to remove all Shadow Copies, or if issues with VSS writers persist, use Diskshadow to investigate the problem and remove remaining copies by using the command line interface on the protected machine. See this article (external link) for more information.