| Event Id | 524 |
| Source | Microsoft-Windows-Backup |
| Description | The System Catalog has been deleted. |
| Event Information | According to Microsoft : Cause This event is logged when the System Catalog has been deleted. Resolution Create a new backup and global catalog If the global catalog has been deleted, you will not be able to access any backups that were created earlier to perform recoveries. This can happen if you or another administrator deleted the global catalog from the boot volume using the wbadmin delete catalog command or by using Catalog Recovery Wizard in the Windows Server Backup snap-in (Wbadmin.msc). You can create a new global catalog by creating a new backup of the computer. To create a one-time backup, you must have membership in Backup Operators or Administrators, or you must have been delegated the appropriate authority. The procedure below describes how to create a backup using the wbadmin command line. You can also create a one-time backup using the Backup Once Wizard in the Windows Server Backup snap-in. To create a new backup using the command line: 1.Open an elevated Command Prompt window. Click Start, point to All Programs, click Accessories, right-click Command Prompt, and then click 2.At the prompt, type: wbadmin restore catalog -backuptarget: Delete the global catalog To delete the global catalog: 1.Open an elevated Command Prompt window. Click Start, point to All Programs, click Accessories, right-click Command Prompt, and then click Run as administrator. 2.At the prompt, type (no parameters): wbadmin delete catalog. Verify To verify that Windows Server Backup is able to perform backup and recovery operations, you should verify that the Block Level Backup Engine service (wbengine) is able to start and that the global catalog and the local catalog have not been corrupted. The global catalog is the file that contains information about all your backups, and the local catalog is the file that contains information about backups saved to a specific destination. Verify that wbengine can start To verify that wbengine can start: Open an elevated Command Prompt window. Click Start, point to All Programs, click Accessories, right-click Command Prompt, and then click Run as administrator. 2.At the prompt, type: net start wbengine. 3.View the text message to verify that the service starts or is already started. Verify the local catalog To verify that the local catalog stored on a backup destination exists and is not corrupted: 1.Open an elevated Command Prompt window. Click Start, point to All Programs, click Accessories, right-click Command Prompt, and then click Run as administrator. 2.At the prompt, type: wbadmin get versions -backuptarget: 3.Verify that command runs without errors. Verify the global catalog To verify that the global catalog on the boot volume exists and is not corrupted: 2.Open an elevated Command Prompt window. Click Start, point to All Programs, click Accessories, right-click Command Prompt, and then click Run as administrator. 2.At the prompt, type (with no parameters): wbadmin get versions.Without parameters this command shows all the backups you have taken that are stored in all locations—that is, information stored in the global catalog. 3.Verify that the command runs without errors. |
| Reference Links | Event ID 524 from Source Microsoft-Windows-Backup |
Catch threats immediately
We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.