Ok, long story short, it all started with a Backup Exec 12.0 job suddenly failing.. One part of the whole job is backuping Exchange Server 2007 using a remote agent and the exchange server. In the job log of Backup Exec, i got a ‘Final error: 0xe000fed1 – A failure occurred querying the Writer status. ‘ ok, initially i thought, this is nothing new.. querying the writer status and seeing what this one’s reporting ..

This is the Backup Exec 12.0 Job log:

Job ended: Donnerstag, 28. April 2011 at 23:00:12
Completed status: Failed
Final error: 0xe000fed1 - A failure occurred querying the Writer status.
Final error category: Resource Errors

For additional information regarding this error refer to link V-79-57344-65233

and this:

Click an error below to locate it in the job log

Backup- server.domain.localV-79-57344-34110 - AOFO: Initialization failure on: "\\server.domain.local\Microsoft Information Store\xyz Storage Group". Advanced Open File Option used: Microsoft Volume Shadow Copy Service (VSS).Snapshot provider error (0xE000FED1): A failure occurred querying the Writer status. Check the Windows Event Viewer for details. Writer Name: Exchange Server, Writer ID: {76FE1AC4-15F7-4BCD-987E-8E1ACB462FB7}, Last error: The VSS Writer failed, but the operation can be retried (0x800423f3), State: Waiting for backup complete notification (5). 

VssAdmin List Writers reported:

Writer name: 'Microsoft Exchange Writer'
  Writer Id: {76fe1ac4-15f7-4bcd-987e-8e1acb462fb7}Writer Instance Id: {c0784b22-2777-47ea-955c-6302ef023141}   State: [5] Waiting for completion
Last error: No error

Checking Event Viewer:

Source: VSS

Event ID: 8193Volume Shadow Copy Service error: Unexpected error calling routine ConvertStringSidToSid.hr = 0x80070539. Operation:
OnIdentify event
Gathering Writer DataContext:
Execution Context: Shadow Copy Optimization Writer
Writer Class Id: {4dc3bdd4-ab48-4d07-adb0-3bee2926fd7f}
Writer Name: Shadow Copy Optimization Writer
Writer Instance ID: {e439464c-084e-42a6-bebb-79f6c877804e}

i got this solved by following MSFT-David Shen’s tip.. => Just deleted a Profile with a .bak extension..

Hi,

According to the research, the issue may be caused by an invalid entry inside the following registry sub tree.

HKey_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\ProfileList

Please open the registry editor with regedit.

Expand and local to the subtree, check if there is an entry that has a ".bak" value appended. If so, this may be cause the failure when trying to resolve the SID of the writer.

Please backup the registry key first, and then delete that entry with the extra ".bak"

Then you may reboot the problematic server to check if it the issue can be fixed.

Ok, this solved the above mentioned error with EventID 8193

But there was another error, kept me from running the backup job successfully..

Source: CAPI2
Event ID: 513
Cryptographic Services failed while processing the OnIdentity() call in the System Writer Object.

Details:
AddCoreCsiFiles : BeginFileEnumeration() failed.

System Error:
Access is denied.
.

Microsoft Technet writes:

Event Details

Product:

Windows Operating System

ID:

513

Source:

Microsoft-Windows-CAPI2

Version:

6.0

Symbolic Name:

MSG_SYSTEMWRITER_ONIDENTITY_FAILURE

Message:

Cryptographic Services failed while processing the OnIdentity() call in the System Writer Object.%1.

Resolve

Modify the access control list on the registration folder

Component Object Model (COM) applications must be able to access the COM+ catalog files that are stored in the COM catalog folder. If the default access control list is changed on the COM catalog folder within the Windows folder, the Shadow Copy System Writer may not work properly.

To perform this procedure, you must be a member of the local Administrators group, or you must have been delegated the appropriate authority.

To modify the access control list on the COM catalog folder:

1. Click Start, and then click Computer.
2. Navigate to %systemdrive%\Windows.

   By default, %systemdrive% is located at C:\.

3. Right-click Registration, click Properties, and then click the Security tab.
4. Click Advanced, and then click Edit.
5. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Continue.
6. Click Edit to view the special permissions assigned to this folder.
7. Ensure that the access control list matches the following criteria:
   • The local Administrators group has Full Control permissions applied to This folder and files.
   • The Everyone group has List folder/read data, Read attributes, Read extended attributes, and Read permissions applied to This folder and files.
   • The local SYSTEM account has Full Control permissions applied to This folder and files.
8. If the permissions on this folder do not match what is listed in this procedure, make the appropriate changes, and then click OK.

Verify

To perform this procedure, you must be a member of the local Administrators group, or you must have been delegated the appropriate authority.

To verify that the Shadow Copy System Writer is working properly:

1. Click Start, point to All Programs, and then click Accessories.
2. Right-click Command Prompt, and then click Run as administrator.
3. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Continue.
4. In the command prompt window, type vssadmin list writers.
5. Ensure that Writer Name: ‘System Writer’ is displayed in the list.

I started Process Monitor and found an ACCESS DENIED on C:\Windows\winsxs\FileMaps\$$.cdf-ms for the NT AUTHORITY\NETWORK SERVICE. Funny, the guys writing Technet Articles and Help for MS don’t even know their own system in deep .. rofl .. however, granting NT AUTHORITY\NETWORK SERVICE the necessary rights, solved also this issue.

here’s my powershell get-history (including typos and retries ), maybe it will help you:

[PS] C:\Windows\system32>Get-History

  Id CommandLine

  — ———–

  14 .\vssadmin.exe list writers

  15 icacls

  16 icacls %windir%\winsxs\filemaps\*.* /grant "NT Service\trustedinstaller:(F)"

  17 .\vssadmin.exe list writers

  18 icacls /?

  19 .\vssadmin.exe list writers

  20 Takeown /f %windir%\winsxs\filemaps\* /a

  21 icacls %windir%\winsxs\filemaps\*.* /grant "NT AUTHORITY\SYSTEM:(RX)"

  22 icacls %windir%\winsxs\filemaps\*.* /grant "NT Service\trustedinstaller:(F)"

  23 icacls %windir%\winsxs\filemaps\*.* /grant BUILTIN\Users:(RX)

  24 icacls %windir%\winsxs\filemaps\*.* /grant BUILTIN\Users:(RX)

  25 icacls

  26 icacls %windir%\winsxs\filemaps\*.* /grant "BUILTIN\Users:(RX)"

  27 .\vssadmin.exe list writers

  28 .\vssadmin.exe list writers

  29 .\icacls.exe %windir%\winsxs\filemaps\*.* grant "NT AUTHORITY\NETWORK SERVICE:(F)"

  30 .\icacls.exe %windir%\winsxs\filemaps\*.* /grant "NT AUTHORITY\NETWORK SERVICE:(F)"

  31 .\icacls.exe %windir%\winsxs\filemaps\*.* /grant "NT AUTHORITY\NETWORK SERVICE:(F)"

  32 .\vssadmin.exe list writers

  33 .\icacls.exe %windir%\winsxs\filemaps\*.* /grant "NT AUTHORITY\NETWORK SERVICE:(F)"

  34 takeown /f %windir%\winsxs\filemaps\* /a

  35 takeown

  36 takeown /f C:\Windows\winsxs\FileMaps\* /a

  37 icaclc C:\Windows\winsxs\FileMaps\*.* /grant

  44 .\icacls.exe c:\windows\winsxs\filemaps\*.* /grant "NT AUTHORITY\NETWORK SERVICE:(F)"

  45 .\vssadmin.exe list writers

The i found this one here:

A product installer – possibly from a 3rd party app has registered that file as being required for a System State backup and not then removed the registration from the System State when the file was removed.

Either identify the vendor of the file and speak to them about a fix – or create a file with the same name in the same folder. Note it is unlikely that you will need the specific file for a restore (assuming your server does restart correctly currently)

So, to have a short break fix, just create a dummy file OR contact the vendor of the driver/program.

Microsoft KB955078 Volume Shadow Copy Service (VSS) System Writer backup fails, and error messages reference nonexistent files in Windows Server 2008

Symantec had a KB entry, but the removed it.. i found it in the Google cache:

——————————

Document ID: 303664
http://support.veritas.com/docs/303664 E-Mail this document to a colleague

System State backup of a Windows 2008 server completes with an exception

Exact Error Message
Backup- System?State System?State
VSS Snapshot warning. File [PATH] [FILENAME] is not present on the snapshot.

Details:

System State backup of a Windows 2008 server may complete with the above mentioned exception if a driver file(s) was deleted/renamed. For example in the Figure 1, 04mmdat.sys is causing the exception.

Volume Shadow Copy Service (VSS) System Writer may list a file to be backed up even though the file is no longer present on the server. View the {GUID}-System_Writer.xml file located in the directory C:\Program Files\Symantec\Backup Exec\Logs to confirm if the writer lists the file present as an exception in the job log.
NOTE:
The exception can be safely ignored as it does not affect the functionality of the Backup set.
Workaround:
Follow the steps listed below:
1. Create a empty text file with the same name as the file mentioned in the exception
2. Place the document in the same location as in the exception
Resolution:
For more details on resolution refer to the following article from Microsoft:
http://support.microsoft.com/kb/955078

Supplemental Material:

System: Ref.#
Description

ETrack: 1264044
VSS Snapshot exceptions happen during system state backup if tape drivers were deleted

Acknowledgements
Microsoft

——————————