locked
Windows Server Backup (WS2012R2) - The Windows Server Backup Service Has Stopped (after Removing Deleted Items) RRS feed

  • Question

  • Hi - am running Windows Server 2012 R2.  Have been consistently running the Windows Server Backup (Bare Metal Recovery) on a nightly schedule, however recently it's stopped completing with this error.  When I monitor the progress, I notice that it occurs right after "Creating shadow copy of volumes" completes successfully and it progresses to the System Reserved backup.  It then changes to the "Removing deleted items" stage per usual, but it's at this point that it fails.  I do not wish to reinstall this Windows Server from a clean install to lose this configuration and will move to an alternate product than Windows Server Backup if necessary.  Preference would be to restore this functionality.

    I've confirmed all vssadmin list writers show no errors.  I've even done a wbadmin delete catalog and completely cleared all backups and recreated the backup schedule.  Have run a chdsk /f on all drives and no errors are reported, including temporarily assigning a drive letter to the System Reserved partition of C:.

    No new software has been installed on this server.  No viruses or malware.  The machine is completely current on all windows update. Even removed antivirus and re-ran the WSB and it consistently returns this same error.

    Event Viewer > Application Error (1000) is reporting the following:

    Faulting application name: wbengine.exe, version: 6.3.9600.19692, time stamp: 0x5e88af65
    Faulting module name: ntdll.dll, version: 6.3.9600.19697, time stamp: 0x5e91f8a1
    Exception code: 0xc0000374
    Fault offset: 0x00000000000f1ce0
    Faulting process id: 0x6154
    Faulting application start time: 0x01d62b9f3b2224a6
    Faulting application path: C:\Windows\system32\wbengine.exe
    Faulting module path: C:\Windows\SYSTEM32\ntdll.dll
    Report Id: 2049e8c7-9793-11ea-82e3-902b343742d3
    Faulting package full name: 
    Faulting package-relative application ID:

    At that same time the System Event (7031) is reported as follows: The Block Level Backup Engine Service service terminated unexpectedly.  It has done this 2 time(s).  The following corrective action will be taken in 300000 milliseconds: Restart the service.

    The Backup > Operational log reports Event ID 100: The scheduled backup was canceled. To create a new backup, you must reconfigure scheduled backups or run a one-time backup operation.

    There should not be any old items for this WSB to remove since I've already complete deleted all existing shadow copies with DISKSHADOW and deleted the wbadmin catalog to start clean.

    It's almost acting as if something in the System Reserved partition on C: might have somehow become corrupted.

    The Windows Server Backup logs folder includes a wbengine0.etl file that I cannot view, however there are no new *.log files created after this error occurs to give me help in resolving this issue.

    I might actually considering paying for a Windows support ticket if it will restore this functionality.

    Thank you in advance.

    Saturday, May 16, 2020 4:54 PM

All replies

  • If I attempt to execute the backup manually, it returns the following:

    C:\Windows\system32>wbadmin start backup -backuptarget:e: -allcritical -systemstate
    wbadmin 1.0 - Backup command-line tool
    (C) Copyright 2013 Microsoft Corporation. All rights reserved.

    Retrieving volume information...
    This will back up System Reserved (485.34 MB),(C:) to e:.
    Do you want to start the backup operation?
    [Y] Yes [N] No y

    The backup operation to E: is starting.
    Creating a shadow copy of the volumes specified for backup...
    Creating a shadow copy of the volumes specified for backup...
    Creating a shadow copy of the volumes specified for backup...
    Creating a shadow copy of the volumes specified for backup...
    Creating a shadow copy of the volumes specified for backup...
    Creating a shadow copy of the volumes specified for backup...
    Creating a shadow copy of the volumes specified for backup...
    The Windows Backup engine could not be contacted. Retry the operation.
    The RPC server is unavailable.

    I am able to successfully telnet to the server on port 135 so RPC is listening.  It does not appear to be a firewall issue either as behaves consistently whether firewall is on/off.

    • Edited by miles267 Sunday, May 17, 2020 3:31 PM updated
    Saturday, May 16, 2020 8:20 PM
  • Hi,

    >>I might actually considering paying for a Windows support ticket if it will restore this functionality.

    Due to the issue need log and trace analyze, I would like to suggest open case to Microsoft.

    https://support.microsoft.com/en-us/gp/contactus81?Audience=Commercial&wa=wsignin1.0

    Thanks for your understanding, if you have any question, please feel free to let me know.

    Best Regards,

    Daniel


    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact

    Monday, May 18, 2020 8:41 AM
  • Confirming I've since opened a ticket with MS Support and am working thru this issue with an engineer.  Since there isn't a documented fix in the forum, I'll try to include details once we get it sorted.
    Tuesday, May 19, 2020 7:05 PM
  • That's good!


    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact

    Wednesday, May 20, 2020 1:17 AM
  • Keeping this thread open as Microsoft SBS hasn't yet been able to identify the cause of the issue.  However I've identified some new info that might help.

    1.) I am able to successfully run a Bare Metal backup via the command line interface with the -allcritical flag to my external backup drive

    2.) I am still unable to perform the same backup via the wbadmin.msc.  The snapin runs and executes, but the block level backup service stops after the shadow copies are created on each drive.

    3.) Since wbadmin.msc calls upon wbengine.exe to perform the Windows Server Backup, I can see that a Windows Update (not sure which one) updated wbengine.exe to version 6.3.9600.19692 in April 2020.  The Microsoft file date of this newer wbengine.exe is 2020-04-04.

    So it appears a Windows Update is the culprit.  When I attempt to rollback all updates at this time period, it will not allow it.  As a result, I'm unable to restore wbengine.exe to a version prior to 6.3.9600.19692 nor can I locate an earlier version anywhere.  Even SFC and DISM will restore wbengine.exe to this newer version if I delete these files and check for corruption.

    Is it possible to obtain the original wbengine.exe file version from the Windows Server 2012 R2 install CD?

    Saturday, May 30, 2020 3:39 PM
  • OK, we will monitor this thread closely.

    And welcome to back to share your new inforamtion at any time.

    Have a nice day!

    Daniel


    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact

    Monday, June 1, 2020 7:55 AM