locked
Win2008 R2 Backup Failure: Volume Shadow copy operation failed for backup volumes with following error code "2155348254" RRS feed

  • Question

  • Failed to get exclusive lock on the Extensible Firmware Interface (EFI) system partition.

      [ Name]  Microsoft-Windows-Backup
       [ Guid]  {1DB28F2E-8F80-4027-8C5A-A11F7F10F62D}
     
       EventID 517
     
       Version 0
     
       Level 2
     
       Task 0
     
       Opcode 0
     
       Keywords 0x8000000000000000
     
      - TimeCreated

       [ SystemTime]  2012-09-13T02:01:26.193377500Z
     
       EventRecordID 134130
     
       Correlation
     
      - Execution

       [ ProcessID]  13508
       [ ThreadID]  552
     
       Channel Application
     
       Computer SERVER.srv.local
     
      - Security

       [ UserID]  S-1-5-17

    - EventData

      BackupTime 2012-09-13T02:00:15.711673900Z
      ErrorCode 2155348254
      ErrorMessage %%2155348254

    Wednesday, September 19, 2012 8:43 AM

Answers

All replies

  • Hi,

    I could not confirm if SP1 is installed for your current Windows 2008 R2 server. Here are some hotfixes for updating some VSS files. Try to install them to see if issue still exists:

    cryptsvc.dll
    http://support.microsoft.com/kb/2647841
    vssapi.dll
    http://support.microsoft.com/kb/2253693
    volsnap.sys
    http://support.microsoft.com/kb/2627052
    vssvc.exe
    http://support.microsoft.com/kb/983426

    Please reboot after installing and if issue still exists, please provide the error in event log again as well as any other error occurs just follow with the Event error 517.


    TechNet Subscriber Support in forum |If you have any feedback on our support, please contact tnmff@microsoft.com.

    Friday, September 21, 2012 7:09 AM
  • Shaon,

    I am receiving an identical error message as the original poster.

    Let me give you some information on my setup and what I have already tried.

    I am running a Windows Server 2008 R2 domain controller with SP1 installed.  The system also runs MS SQL 2008 and IIS.  All critical and recommended updates are installed.

    The server backs up to a set of one of two external hard drives over USB 2.0 every night using Windows Backup.  The external hard drives are encrypted using BitLocker and rotated offsite every week.  We had no problems until 27 November 2013.  On that date I installed the November Windows updates and rebooted.  Backups have not worked correctly since that time.

    The server has two hard drives.  The first one contains an 100 MB EFI partition (created for the IBM System x3200 M3 server EFI hardware although it appears to be entirely empty).  The second partition contains the OS and the SQL databases.  The second hard drive contains shared data files.  None of the partitions are close to being full.

    The backup fails with the following error in the Windows Backup interface:

    EFI System Partition: Windows Server Backup failed to get an exclusive lock on the EFI system partition.  Detailed error: Access is denied.

    The event viewer contains the error listed by the original poster (in the detailed view).  The general view has this description:

    The backup operation that started at <time> has failed with the following error code '2155348254' (Windows Backup failed to get an exclusive lock on the EFI system partition (ESP).  This may happen if another application is using files on the ESP.  Please retry the operation.).  Please review the event details for a solution, and then rerun the backup operation once the issue is resolved.

    This error is thrown about 1 minute after the backup begins.  After encountering the error with the EFI partition the backup exits and does not attempt to backup the other partitions.

    The most interesting detail about the problem is that if I reboot the server and immediately perform a backup it completes successfully.  If I reboot the server and wait approximately an hour before starting the backup it will fail.  The backups will continue to fail until the server is rebooted, at which point I if a backup is started immediately it will succeed but all future backups will fail.  Therefore, it seems that Windows Backup has access to the EFI partition immediately after a reboot but loses access for some reason close to the hour mark (this is an estimate based on a little experimentation but not an exact number).

    Reading the little bit of information available online for this error message I have tried disabling our antivirus (Kaspersky) with no effect.  I have also replaced the first hard drive in the server that contains the EFI partition with not effect (the old hard drive imaged to the new hard drive with no errors, but backups still fail with the new hard drive).  Backups fail with either external hard drive connected, so it is unlikely that the external hard drive is the problem.  I have erased all the Windows Backup settings including wiping all data on the external backup drive and created a new backup with no effect.  I attempted to not backing up the EFI partition but it is required for the system state.  I have reviewed all the Windows updates installed in 27 November 2013 but none of the KB articles reference anything that I could possibly see related to the backup except for possibly the installation of .NET 4.5.1.  However, I do not believe that Windows Backup uses .NET.  'Vssadmin list writers' does not list any obvious errors.

    At this point I am stymied except to think that I have some esoteric hardware failure.  I have contacted IBM support who ran an extensive hardware diagnostic which showed no hardware issues.

    I run several other similar Windows Server 2008 R2 systems, but none of them are on this model of hardware and none of them have an EFI partition.  They all installed the same November Windows Updates.  All of them are able to backup to external hard drives without issue.

    Any support you can provide would be greatly appreciated.

    Sunday, January 12, 2014 12:56 AM
  • Hi,

    Pretty much the same issue here.

    I was able to perform backups until November 4 2013. Now I get the same error.
    But if I disable Kaspersky SmallOffice-Security 3.0 (Fileserver), the backup runs without errors.

    Also after rebooting the system as mentioned by Soren.

    System is also Win Server 2008 R2 on a IBM machine, setup with EFI.

    Did a request at Kasperskys support now... let's see what they say... 

    Tuesday, January 14, 2014 11:23 AM
  • Hi,

    I am also having the same issue here.

    Backup stops after Oct 28, 2013.

    Currently, I am only able to do the backup right after a restart. On any other time, I will be getting 2155348254 error.

     

    System info:

    • Windows Server 2008 R2 SP1
    • IBM Server
    • Kaspersky Endpoint Security 8
    • EFI

     

    I have gone through a lot of posts on the internet but none fixes the problem.

    Please HELP!




    • Edited by Rodney 133 Thursday, January 16, 2014 2:01 AM
    Thursday, January 16, 2014 1:57 AM
  • We are running Kaspersky Endpoint Security 10.  This server is also running the Kaspersky Security Center.  As I mentioned in my original post, disabling it doesn't allow the backups to progress.  However, it is interesting that if Cheaterhand disables his Kaspersky SmallOffice-Security 3.0 (Fileserver) he is able to backup.  Perhaps this relates to some problem with Kaspersky.

    So is the common factor that we all have Windows Server 2008 R2 SP1 on an IBM server with an EFI partition, or is it that we all run a version of Kaspersky's software?  I think I might try completely removing Kaspersky Endpoint Security 10 from the server and seeing if that fixes the problem.

    Is anyone having this problem on a non-IBM server or on a server without an EFI partition?

    Hirikam1, what type of server and what type of antivirus software are you running?

    Tuesday, January 21, 2014 12:23 AM
  • Completely removing Kaspersky Endpoint Security 10 seems to allow the backups to progress.

    I am going to open up a case with Kaspersky and see if they can fix the problems.  I don't consider running without an antivirus software on the server an option.

    Thursday, January 23, 2014 12:41 AM
  • Hello,

    I've been faced with the same issue on a lot of my client's servers using Endpoint 10 Kaspersky on Server 2008 or SBS 2008/2011 and when trying to run the windows back I get the same error to.   It will work if you uncheck the EFI partition BUT that defeats the purpose of a Bare Metal Restore option.

    I was on the phone with Kaspersky and suggested trying Kaspersky Anti-Virus for Windows Server Enterprise Edition     http://www.kaspersky.com/product-updates/windows-server-antivirus-enterprise-edition?chapter=207716541

    I will post again when I've tested it.

    EDIT:  Ok that did work, so on servers that want to use the windows backup for a full backup and use Kaspersky you need to use the Kaspersky Anti Virus Windows Server Enterprise Edition.   After I installed I ran a full scan waited until morning and tried another backup.  (normally it would fail) but this time it started going through

    • Edited by manf0001 Thursday, February 6, 2014 10:28 AM
    • Proposed as answer by manf0001 Thursday, February 6, 2014 10:28 AM
    Wednesday, February 5, 2014 7:53 PM
  • Kaspersky made the same suggestion to us, but Kaspersky Anti-Virus 8.0 Enterprise Edition is so old and lacks so many configuration options that I don't consider it a valid option.

    The problem appears to relate to CryptSvc, the Cryptographic Services.  A Microsoft representative told me that Windows Backup needs to restart this service as part of the initialization of the Windows Server Backup.  I'm not sure that is entirely correct, but I can tell that Kaspersky Endpoint Security 10 depends on Cryptographic Services and Kaspersky Anti-Virus 8.0 Enterprise Edition does not.  This would explain why just disabling Kaspersky Endpoint Security 10 does not alleviate the problem but uninstalling it does.

    Manf0001, who is the manufacturer of the servers that have problems?  Are they all IBM?  I am not having any problems on server from Dell, HP, or those I have built myself.

    Thursday, February 20, 2014 5:08 AM
  • I have already opened up a case with Kaspersky regarding this problem.

    They are still searching for the problem at the moment.


    • Edited by Rodney 13 Tuesday, March 18, 2014 1:59 AM
    Tuesday, March 18, 2014 1:59 AM
  • Just in case if anybody is still looking for a solution. The case has got up to the Kaspersky HQ Expert Team. They have finally figured out what was causing the problem and updated the application modules in Kaspersky Enpoint Security 10.

    So, to solve the problem, all you need to do is to update your KES10 with "Update application modules" enabled.


    • Edited by Rodney 13 Monday, June 23, 2014 1:10 AM
    • Proposed as answer by Stoutner Friday, May 8, 2015 11:15 PM
    Monday, June 23, 2014 1:09 AM