| Event Id | 8213 |
| Source | VSS |
| Description | Volume Shadow Copy Service: Writers does not have enough privileges to create Shadow Copy |
| Event Information | According to Microsoft : Explanation : This event indicates that the writer user account has not been assigned the appropriate privileges. Volume Shadow Copy Service can interact with writers running under the Local System account, local Administrators or local Backup Operators accounts. It can also interact with writers not running under one of those accounts if the account is added to the following registry key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS\VssAccessControl. Cause : The causes for this event are: 1.The writer is not running under the Local System user account. 2.The writer is not running under an account that is a member of the local Administrators or Backup Operators group. 3.The writer account is not listed under the following registry key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS\VssAccessControl. Resolution : Do one of the following: 1.Run the writer under the Local System account. 2.Run the writer under an account that is a member of the local Administrators or Backup Operators group. 3.Add the writer user account to the following registry key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS\VssAccessControl |
| Reference Links | Event ID 1830 from Source VSS |
Catch threats immediately
We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.