| Event Id | 4001 |
| Source | VSS |
| Description | Volume Shadow Copy Service: Cannot find Diff Area for creating shadow copies. |
| Event Information | According to Microsoft : Explanation : To maintain shadow copies, Volume Shadow Copy Service must perform the copy-on-write operation to a shadow copy storage area (also referred to as a Diff Area). If Volume Shadow Copy Service cannot find a suitable volume for storing this area or if it encounters problems in writing to this area, then shadow copies for the volume will be deleted. To successfully create a shadow copy, at least one NTFS volume is required with at least 300 megabytes (MB) of free space. Cause : Possible causes include: An issue is preventing Volume Shadow Copy Service from finding or writing to a suitable volume for the Diff Area. Resolution : Do one of the following: 1.Reduce the system or I/O load and retry the operation. 2.Check the Diff Area association and configuration. 3.Check the volume where the Diff Area is stored for errors or hardware issues. 4.Do not store the Diff Area on any kind of storage device that can be easily removed from the system. 5.Do not store the Diff Area on any kind of storage device that may not be available to Windows until late in the system startup sequence. For example, a LUN created on an Internet SCSI (iSCSI) storage subsystem may not appear until a software initiator has started. |
| Reference Links | Event ID 1830 from Source VSS |
Catch threats immediately
We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.