| Event Id | 27 |
| Source | VolSnap |
| Description | The shadow copy of volume X: could not be created due to a failure in opening the critical control files |
| Event Information | According to Microsoft: Cause : This problem occurs when you import a transportable snapshot that is set to read-only.Because the transportable snapshot is read-only, the volume that the transportable snapshot contains is read-only. The Volume Shadow Copy Service driver (Volsnap.sys) does not distinguish a differential software shadow copy from a read-only volume. Volsnap.sys tries to remove the differential software shadow copy in the transportable snapshot. When Volsnap.sys cannot remove the differential software shadow copy, the event in the "Symptoms" section is logged. Resolution:You can safely ignore this event. |
| Reference Links | Event ID 27 from Source VolSnap |
Catch threats immediately
We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.