Storm season is back, bringing with it the potential for significant weather events. If you have clients in areas prone to infrastructure disruption, visit the Disaster Recovery Resources guide for preparedness information. Datto recommends performing proactive disaster recovery testing to mitigate potential downtime. See our articles about the importance of disaster recovery testing and Preparing For A Cloud Virtualization Test: Policies, Procedures, And Partner Responsibilities to learn more. For live updates, follow @datto on Twitter.

Backups Fail with STC 401 or Job (500) Was Unable to Be Assigned Errors on Server 2008 and 2012



Backups fail with STC 401 or job (500) was unable to be assigned errors. 


  • Datto ALTO
  • Datto SIRIS


This article explains how to fix a specific permissions-based issue on Windows Server 2012 R2, which causes backups to fail with a 401 or 500 error, after a random amount of days following an uninstall and reinstall of the ShadowSnap application.

While this issue presents mainly in Windows Server 2012, you can apply these steps to earlier versions of the Windows OS as well.


Windows server will start failing backups with a STC 401 or 500 error after an uninstall and reinstall of the Shadow Snap agent on the server.  After the error, if the agent is uninstalled and reinstalled again, backups will work for a few days before the error returns.

Figure 1 shows a version of the 500 as seen from the command line of the Datto appliance. It is viewable through the web UI by going to the Protect tab and selecting Backup Logs for the agent having trouble pairing, then selecting Agent Logs

Figure 1: 500 error as seen on the back end

Possible Causes

Multiple Datto appliances protecting a single server

If agents are taking constant full backups or differential merges at random intervals, or are encountering intermittent 401, 500, or VSS writer errors, there may be more than one Datto appliance on the network trying to back up the same protected machine.

Datto does not recommend protecting a production system with more than one Datto appliance at the same time. Even if the appliances have different scheduled backup times, both systems cannot work in tandem with each other. Both store information in the same location on the protected server with the same naming schemes, and will overwrite each others' changes to those files. 

Group Policy issues

This is caused by a group policy applied to the server which limits the Local System User permissions, so the services started as the Local System User do not have full access to the Program Files directory as they did on initial installation. 

A list of the symptoms for this specific group policy issue follows:

  • Machine is a Windows Server 2012 / R2 and commonly is the environment's Domain Controller, but this has been observed on Exchange machines as well.
  • The backups start to fail with an STC error 401 or 500 
  • The ShadowSnap application is able to be uninstalled and reinstalled and the backups will continue to work for a limited amount of time
  • The agent logs read three 500 errors followed by three 401 errors as displayed in the screenshot above.
  • VSS Errors in the registry (typically) with event ID 8193 "Access is denied"

If all of these symptoms are being observed the following steps have had a very high resolution  rate. 


Stop the four services that get installed upon ShadowSnap agent installation, then restart them under a domain administrator account. 

For servers not on a domain, appply this resolution using the local administrator credentials instead of the domain credentials.
  1. Repair Agent Communications to re-pair the agent with your Datto appliance. The ShadowProtect software automatically attempts to reprovision its license during this process.
  2. Open the services window by opening a run command and then typing: services.msc.
  3. Stop the following services:
    • ShadowProtect Service Properties
    • StorageCraft Image Ready (if this service is running, change its startup type to manual after stopping it)
    • StorageCraft Raw Agent
    • StorageCraft Shadow Copy Provider
  4. Next, right click on the each of those four services and select properties.
  5. In the properties window select the Log On tab.
  6. Next, change the Log on as: property from Local System Account to This Account
  7. Please enter a domain administrator account for these services by browsing the domain accounts.

Figure 2: ShadowProtect service properties

  1. After all of the services have had the domain account inserted to the log on pages, kill all related services through task manager, and start the services in the following sequence: 
    • StorageCraft Shadow Copy Provider

    • StorageCraft Raw Agent

    • ShadowProtect Service

  2. In the web UI, choose the Protect tab, and select the Configure Agent Settings\], then click Repair Agent Communication.  After this has completed go ahead and force-start a backup through the web UI.  
  3. When the repair completes, start a backup through the web UI. 

tact Datto Technical Support. 


Was this article helpful?

5 out of 7 found this helpful

You must sign in before voting on this article.

Calling all Partners! We want to hear your feedback! Please participate in this quick survey and help us build a better, more-relevant Knowledge Base!

Want to talk about it? Head on over to our Community Forum!