Disabling and Purging Shadow Copies on Windows Servers



Shadow Copy (also known as Volume Snapshot Service, Volume Shadow Copy Service or VSS) is a technology included in Microsoft Windows. It is capable of taking manual or automatic backups computer files or volumes, even when they are in use. It runs as a Windows service named Volume Shadow Copy.

Shadow Copies can also be created by any Windows component that uses Volume Shadow Copy's VSS provider service. Components which use this service include Windows Backup and System Restore.


Having Shadow Copies present on a system protected by a Datto device can throw off incremental counters, cause conflicts, and can take up storage space that backups need to be able to run.

You will need to purge any orphaned Shadow Copies from your protected machine, and disable the service to avoid future conflicts. This article details how to disable and remove Shadow Copies.

You will also need to make sure that any other backup solutions are uninstalled from the protected system, as they can cause conflicts and failures with our backup solution.


Microsoft Windows Server 2003 & 2008/R2

If you are using NTBackups on Server 2003, follow the steps in the Legacy Windows section of this article.

1. Open Windows Explorer or the Microsoft Management Console (MMC) Disk Management snap-in, and then right-click the drive.

2. Select Properties from the context menu.

3. Select the Shadow Copies tab.

4. Highlight each volume being backed up, and select Disable.

If there are any Shadow Copies under the Shadow Copies of selected volume section, click Delete Now. Make sure that no Shadow Copies remain.


Figure 1: Shadow copies of selected volume


Figure 2: Volume with purged Shadow Copies

You can also use an elevated command prompt to confirm that the Shadow Copies were removed.

Microsoft Windows Server 2012

1. Open File Explorer, and right-click the volume that you want to disable Volume Shadow Copies on. Select Configure Shadow Copies.


Figure 3: Configure Shadow Copies

2. Select the volume, and click Disable. Then, click Delete Now.

Microsoft Windows Workstations (Vista, 7, 8, 8.1, and 10)

1. From the Windows Start Menu, navigate to Control Panel, and then click System and Maintenance, System and Security, or System.

2. Click System → System Protection.


Figure 4: System protection

3. To disable Volume Shadow Copy, uncheck the box next to each volume you want to exclude, as shown in Figure 5. For Windows 8 and Windows 10, you might need to click Configure, followed by Disable system protection for each volume, as shown in Figure 6.


Figure 5: System properties


Figure 6: System Protection

4. A dialog box will appear asking if you are sure you want to turn off System Restore. Click the Turn System Restore off button or the Yes button. Then, click OK.

Legacy Windows: Microsoft Windows Server 2003 & Windows XP (NTBackup)

NTBackup is a built-in backup application that was bundled with all versions of Windows, beginning with Windows NT and ending with Windows Server 2003. The application was replaced by Windows Backup with the release of Windows Vista. To remove jobs from NTBackup, follow these steps:

1. From the Run prompt, type ntbackup. You can also access the application from the Start menu, by clicking Start  → All Programs  → Accessories  → System Tools  → Backup.

2. If NTBackup launches in Wizard Mode, switch to Advanced Mode by unchecking the Always Start in Wizard Mode check box. Then, click Advanced Mode  → Schedule Jobs.


Figure 7: Schedule Jobs

3. Right-click the tasks that you want to remove, and then click Delete. You can also remove the task by navigating to Start  → Settings → Control Panel → Scheduled Tasks.

4. If removing the tasks does not stop NTBackup from running, you can navigate to %SystemRoot%\Windows\System32\ntbackup, and rename the ntbackup.exe executable to _ntbackup.exe. This will prevent Windows from running the NTBackup application.

Removing Shadow Copies through an elevated command prompt

You can remove Shadow Copies from a host system from an elevated Command Prompt session. After disabling Shadow Copies through Windows, launch a Command Prompt with Administrator privileges, and run the vssadmin list shadows command. If no Shadow Copies are present, you will see the output shown in Figure 8.


Figure 8: vssadmin list shadows

1. To remove Shadow Copies for a specific drive, run the Vssadmin delete shadows /For=:<driveletter> /all command. Replace <driveletter> with the letter of the system volume you want to remove the Shadow Copies from, as shown in the below example. 

Microsoft Windows [Version 10.0.10586]
(c) 2015 Microsoft Corporation. All rights reserved.

C:\Windows\system32>vssadmin delete shadows /For=C: /oldest
vssadmin 1.1 - Volume Shadow Copy Service administrative command-line tool
(C) Copyright 2001-2013 Microsoft Corp.

Do you really want to delete 1 shadow copies (Y/N): [N]? y

Successfully deleted 1 shadow copies.


2. To remove all Shadow Copies from all volumes, run vssadmin delete shadows /all from the command line.

3. If this fails to remove all Shadow Copies, or if issues with VSS writers persist, use Diskshadow to investigate the problem and remove remaining copies by using the command line interface on the protected machine. See this article (external link) for more information.

Was this article helpful?

11 out of 13 found this helpful

You must sign in before voting on this article.

Want to talk about it? Head on over to our Community Forum!