Save to My DOJO
Table of contents
A customer using Altaro Hyper-V Backup on Windows 2008 R2 Enterprise SP 1 contacted us because attempts to back up a virtual machine that had Small Business Server 2011 (SBS) installed were failing due to a VSS error.
We began troubleshooting by collecting the Altaro Error Logs, Windows Application and System Event Logs, and a dump of the VSS Writers and Providers from the Hyper-V host.
From the Altaro Error logs, we saw that the VSS request was failing with the error VSS_E_WRITERERROR_RETRYABLE (0x800423F3L). Normally, the cause of VSS errors can be determined by checking the Windows event logs, but in this case, those contained no clues. That typically means that the underlying problem is within the virtual machine itself.
We accessed the Application and System Event Logs from the SBS 2011 virtual machine itself. The Application event log held many VSS warnings, verifying that the problem stemmed from a condition within the SBS 2011 VM.
All VSS warnings had the same ID – Event ID 8230.
Event ID: 8230 | Source: VSS | Level: Warning |
Volume Shadow Copy Service error: Failed resolving account spsearch with status 1376. Check connection to domain controller and VssAccessControl registry key.Operation:Gathering Writer DataExecutingAsynchronous OperationContext:Execution Context: RequestorCurrent State: GatherWriterMetadataError-specific details:Error: NetLocalGroupGetMemebers(spsearch), 0x80070560, The specified local group does not exist. |
The pivotal item in the event description is the reference to the VssAccessControl registry key. We retrieved a copy of the customer’s “HKEY_LOCAL_MACHINESYSTEMCurrentControlSetservicesVSSVssAccessControl” registry key and immediately saw that, apart from the “NT AuthorityNetworkService” account, there were 2 other accounts present.
At this point we fired up our test SBS 2011 test server for comparison and found the same accounts in the same location.
[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetservicesVSSVssAccessControl] “NT Authority\NetworkService”=dword:00000001 “ALTSBS\spsearch”=dword:00000001” ALTSBS\spfarm”=dword:00000001 |
As you can see, one of the accounts (spsearch) is the same one referenced in the event 8230. With this information, we started an Internet search for more information about this issue. Everything we found seemed to point to Microsoft Sharepoint, primarily because both the “spsearch” and “spfarm” accounts are Sharepoint accounts. We also found posts by people that were experiencing similar issues with non-Altaro backup software. They were able to get backup working again by deleting the references to the “spsearch” and “spfarm” accounts.
This presented a conundrum. Backups of our own test SBS 2011 VM were not failing which meant that the presence of these accounts alone could not account for the failure; we had to find the difference that would allow us to reproduce the issue that the customer was experiencing. Because the customer’s SBS installation had been upgraded to service pack 1, we updated ours. This made no difference. We queried the customer to see if he knew of any other changes to the system. He told us that in August, he had installed Service Pack 1 for Sharepoint 2010 Foundation. We installed that on our test VM as well and – bingo! We experienced the same issue: backups failed with errors similar to those that the customer experienced.
We tested our finding by modifying the registry as shown (for reproduction purposes only):
- Open “regedit.exe”
- Browse to the [HKEY_LOCAL_MACHINESYSTEMCurrentControlSetservicesVSSVssAccessControl] key
- Make a backup of that key (these steps are presented so you can reproduce them, not make them permanent)
- Change the DWORD value of ‘ALTSBSspfarm’ from 1 to 0
- Change the DWORD value of ‘ALTSBSspsearch from 1 to 0
- Restart the ‘Microsoft Software Shadow Copy Provider’ service
- Restart the ‘Volume Shadow Copy’ service
- Retry Backup
Backups succeeded! To confirm, we reverted the entries and restarted the Volume Shadow Copy Service and tried a backup, which failed. This let us know that we were on the right track, but Microsoft placed those accounts there for a reason. We continued our research and stumbled upon a blog post by Susan Bradley [SBS Diva]. This article explained that if Sharepoint Service Pack 1 is installed on SBS 2011, an extra step is needed. The user must run the “psconfig” command to fix Sharepoint and backups. We followed Susan’s instructions as shown in the Solutions section, and the backups worked! This allows us to correct the problem without changing Microsoft’s settings for the SharePoint accounts.
We directed the customer to Ms. Bradley’s blog. His response was: “I ran the PSCONFIG command as you requested and it fixed it! Thanks for your excellent support!”
Solution
- Open an Administrative command prompt
- Change directory to C:Program FilesCommon FilesMicrosoft SharedWeb Server Extensions14BIN
- Run “PSConfig.exe -cmd upgrade -inplace b2b -force -cmd applicationcontent -install -cmd installfeatures”
Thank you Susan Bradley!
![](https://www.altaro.com/hyper-v/wp-content/themes/dojo/assets/images/sub-dojo-home/mascot.png)
Not a DOJO Member yet?
Join thousands of other IT pros and receive a weekly roundup email with the latest content & updates!
11 thoughts on "SBS 2011 Backups Failing – VSS Error 0x800423F3 – Event ID 8230 (spfarm, spsearch)"
More Infos about this issue can be found here:
http://blogs.technet.com/b/sbs/archive/2011/07/06/potential-issues-after-installing-sharepoint-foundation-2010-sp1.aspx
Spot On! WHat they fail to tell you, is that SP1 for 2010 sharepoint is installed via Windows Update. So you don’t always know it’s been applied, unless you go hunting. Ran this PSconfig command today, and remedied my issue (after deleting and reconfiguring the backups).
What annoys me about the upgrade process on the latest SBS operating systems is that you need to perform these manual tasks after the microsoft updates. SBS is supposed to be a fairly hands off OS for small businesses with little or no IT support. Having to dig around and find these CLI commands is not good and I’m sure they could be built into the upgrade process. The same applies to changing the defaults send and recieve values for Excange, using the Exchange console and entering a series of get and set strings is not what I call simple OS management.
Other way to solve this issue consisting in removing third party vss providers registry records (obsolete ones) as explained here : http://social.technet.microsoft.com/Forums/en/winservergen/thread/ee8d3dd2-99be-4eaf-80e7-7d2819a0c4fa
Thanks for sharing! I had the exact same issue with Acronis Backup & Recovery 11 for SBS 2011 and resolved it with this solution.
Great article – deep research to that problem. Thanks for sharing this to all of us!
André
Thank you so much for posting this. We could not figure out why backups suddenly stopped working a couple weeks ago after some overdue updates.
It said there was more configuration needed for sharepoint, but we did not do it as we do not use sharepoint.
If all of that fails, try this https://support.microsoft.com/en-us/help/2537096/you-may-get-vss-warnings-in-the-application-event-log-of-sbs-2011-stan. It worked for me.
I created the group in the Users OU, not the SBSUsers OU.
As a temporary solution to get the backup to run, you can simply manually start the VSS service and resolve the issue later. We were unable to run the PSConfig.exe command because of other permission issues with SQL and the backup couldn’t wait.
hi, maybe, the real problem ist the not to delete any registry key or to change values from 1 to 0. look closer at the error message from event 8230, VSS – the error specific details are: NetLocalGroupGetMemebers(spsearch)… and so on where you can see the the word “Memebers” ist not written down correctly.
Dont you think that the resolution would be to change that word to correct
word? Who can tell me how to change that? Feel free to answer or mail me, thank you! K.R.
Hi Andi,
Good observation about the misspelling. This was a ‘typo’ in the original release of Windows Server, and it was corrected in a later release. Here is the current/latest documentation: https://docs.microsoft.com/en-us/windows/win32/api/lmaccess/nf-lmaccess-netlocalgroupgetmembers
Thanks,
Symon Perriman
Altaro