Getting Started with the ShadowSnap Agent



How do I get started with the ShadowSnap agent?


  • Datto ALTO
  • Datto SIRIS



Datto's ShadowSnap Backup Agent protects local physical and virtual Windows machines in conjunction with Datto's business continuity appliances: SIRIS and ALTO.

Before you install the ShadowSnap agent on a server, refer to the Server State Checklist below. It is extremely important to run a virus scan, disk defragmentation, and a disk health check (chkdsk /r) before installation.
Datto recommends reviewing the Backing up Encrypted Operating Systems Knowledge Base article when deploying the agent to encrypted machines.
New versions of the ShadowSnap agent require the device to run Datto OS software v.3.68.8 or higher.

The ShadowSnap solution has two components: ShadowSnap and ShadowProtect. Datto's web interface requires both of these components.

There is no ShadowSnap interface on the locally protected machine; however the ShadowProtect program is available from the Start menu of a protected system with the full ShadowSnap package installed. After installation, both components are listed in the Add/Remove Programs control panel.

The current version of ShadowSnap is version 4.0.0 and requires a server reboot to finalize its install. It works in conjunction with ShadowProtect MSP version 5.0.1.

The ShadowProtect software contains the ShadowSnap agent, the method by which the Datto appliance communicates with the protected machine to perform a backup.

The ShadowSnap agent uses VSS writers to capture application-aware backup images. In case of failures in specific VSS providers, ShadowProtect also has a fallback: the StorageCraft Shadow Copy Provider. This service only requests the most important VSS writers to deliver a crash-consistent backup.

The ShadowSnap agent captures backups at the volume level. In other words, it backs up entire partitions, not individual files and folders. If there is data that you do not want to back up, relocate it to a separate partition, and exclude it from backup images.

Any block level change on the protected agent is accounted for in backup. This includes other backups, certain maintenance tasks, or failures that interfere with the file system. ShadowSnap can only back up volumes that are recognized by the Windows operating system as local, stable volumes. ShadowSnap / ShadowProtect cannot back up mapped network drives.

If you have an application that does not have its own VSS writer to properly freeze/thaw the application's database in the event of a VSS-aware backup, we recommend that you configure that software to use its own backup service.


See this article for a complete list of the ShadowShap agent's system requirements. Compatibility of this backup solution with any hypervisor environment or operating system not listed is untested, and may yield unreliable results.

Potential Conflicts

  • Backup software is like anti-virus software: Having more than one in place is problematic as they will conflict. Disable or remove all other backup software. When removing, use a high level uninstaller that removes all traces of the program after deployment, including registry keys, dlls, and stray folders. These components can cause conflicts.
  • Acronis usually prevents installation of the ShadowSnap agent. For any machine that previously had Acronis, follow the steps in this article: Removing Acronis.
  • Datto does not endorse or support backing up laptops with the ShadowSnap software due to their mobile nature; laptops must be inside the LAN and not on a wireless network to perform backups in a timely manner. Attempts to do so are at your own discretion.
  • The date and time settings of on the protected machine must correspond with the correct time zone in which this device resides.
  • There is a known issue with the Synaptics Touchpad Driver and the VirtualBox Guest Additions software.
    • Older versions of the driver can cause a BSOD of the laptop itself.
    • Synaptics Touchpad Driver Version - 9/15/11 is compatible.
    • Subsequent versions are able to accept the ShadowSnap installer.
The Datto solution is capable of backing up multiple types of disk sector schemes. The process writes an image-based backup to a file which is 512 bytes per physical sector. While rare, certain software which relies on advanced formats, such as 4K, may have issues with the sector size change. Datto recommends performing regular DR tests to ensure that all required applications function as expected in our virtualized environments.

Server State Checklist

Follow these tips to get your server in shape for smooth backups:

  • Hardware health: Run chkdsk to be sure that all RAIDs and individual disks report back as healthy. Run any necessary disk repairs before the deployment of any backup agent. Failure to do so may result in backing up corrupted systems and may result in restoration failures.
  • Disk defragmentation: While we can support backups that are running disk defragmentation, be aware that this rearranges data at a block level, and larger backups will consequently result. Run a disk defragmentation before deployment of the agent. VSS-aware disk defragmentation programs may allow for smaller backups, but this would be left to your own discretion.
  • Download Windows updates, service packs, and any other Microsoft provided updates. After installing these updates, reboot the server. When scheduling your deployment, remember that the 2nd Tuesday of every month is Microsoft's "patch Tuesday."
  • Virus Scan: Run a virus scan before you deploy the ShadowSnap agent.
  • Event Viewer: Check the target's system and application logs to see if there are any VSS or hardware errors. Resolve any errors before attempting to install the agent.
  • SQL: Check for SQL maintenance jobs that may be taking place, as they are a separate backup solution and may cause conflicts. To avoid very large incremental backups, Datto recommends to have SQL maintenance jobs saved to a partition that is unprotected by the Datto. If the Datto is set to protect the volume that has the SQL maintenance jobs saved, the local Datto may fill up, causing it to not sync to the Cloud properly. Best Practices for SQL servers can be found here.
  • Exchange: Since Exchange Servers are essentially database servers with mail stores in EDB (Exchange Database Format), Datto recommends the same process for maintenance jobs that would be had with SQL as well as Exchange (see above SQL recommendation). Make sure that the Exchange writers are enabled on your operating system. Also, check for additional archiving tools such as auto-archiving that may cause larger incremental changes.
    • For Exchange 2010 and 2013, Datto recommends that you enable circular logging.
    • For earlier versions, VSS backups will truncate logs upon completion and circular logging can be disabled.
  • DFS: Distributed file systems on servers that stage and replicate files and folders to other places may also account for larger backups. Consider the role of DFS before deployment, and consider that it may take larger backups if the files are staged at a particular time. DFS shouldn't cause large changes, as long as the transfers are occurring as expected and the VSS writer that maintains them remains stable. See How Distributed File System (DFS) Interacts with the Datto Solution for more information.
  • Hypervisors: Datto recommend that hypervisors have their datastores isolated on a separate partition, and that the non-datastore volumes be backed up by the ShadowSnap agent. Servers that reside on the datastore should be backed up individually to allow for more granular recovery and restore efforts. Best practices for backing up hypervisors can be found here.
  • Clustering: ShadowSnap supports backing up guest VMs running on a Hyper-V host that uses CSV as storage solution if the backed-up VM is not hosting additional VMs which are also stored on the CSV. ShadowSnap does not support backing up Hyper-V hosts themselves. Where a CSV connection exists, you will need to back up the independent VMs with individual agent installations.
  • Proxies: ShadowSnap and ShadowProtect do not support the use of proxy servers on the network. Agents check in to StorageCraft to verify their license monthly.

Server Tuning

Here is another excellent resource from Datto's partners at StorageCraft: StorageCraft Server Tuning Guide

Many of these settings can significantly improve the reliability of the backups, especially any network latency issues or disk input / output issues. Since these steps involve manipulating the registry, take a backup of the registry before making any changes.

Pre-Deployment Requirements

The following are requirements for your target server and your network:

  • Gigabit connections from the Datto to all relevant network infrastructure (Check switch ports, try to have the Datto appliance on a gigabit switch whenever possible)
  • An active internet connection is required. 
  • Firewall rules:
    • From protected machine to Datto appliance: TCP 3260 (iSCSI port), UDP 139, and TCP 25566 (Live when the StorageCraft Raw Agent service is enabled and running, check with netstat).
    • From Datto appliance to internet: 22, 80, 123, 443 outbound to at minimum the addresses specified in this article: Datto IP Ranges.
  • Additional addresses may need to be needed for the continuity of off-site syncing, articles on additional IP ranges can be found on the knowledge base under Datto IP Ranges.
  • Verify that no other backup software is installed on the machine, especially other versions of ShadowProtect, as Datto's software requires the MSP version of ShadowProtect.
  • Be sure that anti-virus is temporarily disabled for deployment. After installation, you will need to configure your anti-virus to ignore the StorageCraft folder.
  • StorageCraft provides a downloadable tool to analyze a system for ShadowProtect compatibility, which is available here.
  • To ensure successful backups, a minimum of 20% free space per protected volume, and 1 GB of RAM, need to be available on the production machine. If resources fall below these thresholds, backups can begin to fail.

     Volume Utilization



    0 – 70%


    Utilization is good.

    71 – 80%


    Utilization is outside optimal limits. Monitor the volume growth and look at cleaning up unnecessary files and moving non-essential data to other storage.

    81 – 100%


    Volume is becoming critical. Snapshots will start to fail, disk queue lengths will increase. Create space.

Figure 1 illustrates the data flow for the ShadowSnap Agent.

Figure 1: ShadowSnap Agent & Shadowsnap Encrypted Agent logical data flow (click for larger image)


1. After the server has been checked, you can run the installer. Go to, scroll down to Additional downloads, and click ShadowSnap Installer. When the installer finishes downloading, run the executable with Administrator privileges. Running the installer without elevated privileges may cause the installer to exit with the error "ShadowProtect installation failed." 

Figure 2: Shadowsnap on

2. Click Next to start the ShadowSnap Setup.

Figure 3: Shadowsnap installation wizard

3. Select the destination folder for the installer, and click Next.

4. Click Install.

5. The ShadowSnap installer will also install VirtualBox Guest Additions.

6. Click Next once the installer has completed.

SS5.jpgFigure 4: Installation complete

7. Click Close (either restart immediately or later). Backups will not function until the system has been rebooted.

8. You are now able to pair the protected machine with the SIRIS device and proceed to start backups. Don't forget to configure your backup settings. If you receive an integrity check error, proceed to this article.

While you can schedule a reboot later, you will need to reboot before the backup driver can be loaded. At this time, you may pair the agent to the Datto device and begin configurations. However, backups will not run until after the reboot.

Setting Schedules / Initial Configurations

Here are some items to consider when configuring ShadowProtect:

  • Consider your client’s needs, and discuss this with them before providing the schedule: how far would you need to feasibly go back to retrieve data? Set the expectations with them and provide a schedule accordingly. Set the local data retention policies based on these conversations and expectations. Remember that long-running retention policies will require more disk space, and should be considered when sizing an appliance.
  • Consider the server’s application: while a file server may need to be backed up during business hours as files are in constant change, a terminal server that simply houses configurations may not require as many backups per day as there is little to no change provided. Backups are just like any other service on a server, they consume resources and take disk input / output. Consider this while setting a schedule.
  • Before you take the first backup, make sure that any volumes that you do not want to be backed up are excluded from the advanced options tab. Remember that any additional drive that is attached to the machine may attempt to be backed up (USB drive, additional storage drive, etc.)
For information on other Datto SIRIS configurations, see also Configuring Alerts and SpeedSync.

Verify Installation

Follow these steps to verify that the installation was successful:

  1. Make sure that all 3 essential services are present and running: ShadowProtect Service, StorageCraft Raw Agent, and StorageCraft Shadow Copy Provider.
  2. A Quick test of the services would be to restart from services.msc and see if they stop and start cleanly.
  3. Open up the ShadowProtect software on the device. The lower left tab should show an active license.
  4. Check out the agents tab after pairing the agent to the device, the agent should populate as ready to accept a backup.

Updating the ShadowSnap Agent

The ShadowSnap Agent does not automatically update itself when a new version becomes available. You will need to download and install these versions manually. You can download the latest releases of the ShadowSnap agent at the Datto Download Page. A Partner Portal login is required to download the agent.

You do not need to uninstall the ShadowSnap agent to update it. Running the installer for the latest release will upgrade your existing installation.

To ensure reliability of your backups, Datto recommends installing ShadowSnap updates as they become available.

You can check the protected machine's agent version from the Protect tab of your Datto appliance's GUI.

Additional Resources

Was this article helpful?

20 out of 25 found this helpful

You must sign in before voting on this article.

Calling all Partners! We want to hear your feedback! Please participate in this quick survey and help us build a better, more-relevant Knowledge Base!

Want to talk about it? Head on over to our Community Forum!