| Event Id | 9 |
| Source | Microsoft-Windows-Backup |
| Description | Backup started at '%1' failed as Volume Shadow copy operation failed for backup volumes with following error code '%2'. |
| Event Information | According to Microsoft : Cause This event is logged when backup started and failed because Volume Shadow copy operation failed for backup volumes. Resolution Fix VSS and SPP failures As part of a backup operation, Windows Server Backup must be able to take a shadow copy of the volumes being backed up. Review Event Viewer for Volume Shadow Copy Service (VSS) and Shared Protection Point (SPP) failures to look for solutions, and then re-run the backup. To perform these procedures, you must have membership in Backup Operators or Administrators, or you must have been delegated the appropriate authority. Review event details in Event Viewer To review event details in Event Viewer: 1.Open Event Viewer. Click Start, click Administrative Tools, and then click Event Viewer. 2.In the left pane, double-click Windows Logs, and then click Application. 3.In the right pane, view the Source column, and look for events from VSS or SPP at or after the time the backup operation started. 4.Click an event of interest, and then click the General tab. 5.Resolve any failures that you find. Perform a backup To perform a one-time backup: 1.Open an elevated Command Prompt window. Click Start, point to All Programs, click Accessories, right-click Command Prompt, and then click Run as administrator. 2.At the prompt, type: wbadmin start backup. Use parameters, as needed. Verify To verify that backup operations are running, or will run, successfully, you should do one or more of the following, as needed: For any backup operations that you have run, look for Event ID 4, which indicates that the operation completed successfully with no errors. Verify that no other backup or recovery operations are running so that you can start an operation Verify that you have enabled a scheduled backup, and is configured correctly. Verify that the location where you plan to store your backups is available and online. To perform these procedures, you must have membership in Backup Operators or Administrators, or you must have been delegated the appropriate authority. Verify the backup completed with no errors To verify that a backup operation completed with no errors: 1.Open Event Viewer. Click Start, click Administrative Tools, and then click Event Viewer. 2.In the left pane, double-click Applications and Service Logs, double-click Microsoft, double-click Windows, double-click Backup, and then click Operational. 3.In the Event ID column, look for event 4. 4.For this event, confirm that the value in the Source column is Backup. Verify another operation is not running To verify that another backup or recovery operation is not running: 1.Open an elevated Command Prompt window. Click Start, point to All Programs, click Accessories, right-click Command Prompt, and then click Run as administrator. 2.At the prompt, type: wbadmin get status. 3.If the command output indicates that no operation is running, then you can start a backup. Verify scheduled backup is enabled To verify that a scheduled backup is enabled: 1.Open an elevated Command Prompt window. Click Start, point to All Programs, click Accessories, right-click Command Prompt, and then click Run as administrator. 2.At the prompt, type: wbadmin enable backup. 3.If the command output shows a schedule, then a scheduled backup is enabled. 4.Confirm that the schedule contains the correct parameters. Verify storage location is online To verify that a disk used to store backups is online: 1.For the computer that contains the storage disk, open Disk Management. Click Start, click Run, and then type: diskmgmt.msc. 2.Click View, click Top, and then click Disk List. 3.For the disk that contains the volume that you will use to store backups, confirm that the value in the Status column is Online. |
| Reference Links | Event ID 9 from Source Microsoft-Windows-Backup |
Catch threats immediately
We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.