Backup & VSS — Cheat sheet

Windows backup and VSS reference covering 3-2-1-1-0, RPO/RTO, writers, providers, shadow storage, events and restore validation.

Strategy & objectives

3-2-1-1-0 — Three copies, two media types, one off-site copy, one offline or immutable copy, and zero errors after recovery verification. This is a resilience principle, not a product configuration.
RPO — Maximum acceptable data loss, used to define backup frequency.
RTO — Maximum acceptable recovery time, including detection, restoration and return to service.
Restore test — Test file, VM or application recovery regularly. A successful job alone does not establish recoverability.

Writers — vssadmin list writers — Compare each required writer’s state and last error with the job timing.
Providers — vssadmin list providers — Lists registered Microsoft and third-party snapshot providers.
Shadow copies — vssadmin list shadows — Lists existing snapshots without deleting them.
Shadow storage — vssadmin list shadowstorage — Reports configured storage associations and capacity.

VSS — Get-Service VSS — Record the service state; a stopped demand-start service outside an operation does not by itself prove a fault.
Software provider — Get-Service swprv — Correlate the state with the provider actually used.
COM+ Event System — Get-Service EventSystem — Check additional application services according to the failed writer.
Writer state before/after — vssadmin list writers — Preserve the original failed state before a restart.

VSS events — Get-WinEvent -FilterHashtable @{LogName='Application';ProviderName='VSS';StartTime=(Get-Date).AddHours(-8)} — Compare the timestamps with the backup job.
VolSnap events — Get-WinEvent -FilterHashtable @{LogName='System';ProviderName='volsnap';StartTime=(Get-Date).AddHours(-8)} — Review snapshot and storage-related errors.
Event 8193 — Read the full HRESULT and component details. The number alone does not establish the cause or the effect on the backup.
Event 12289 — Correlate the snapshot error with its provider, volume, I/O and capacity. An empty query or limited log access does not prove that the system is healthy.

Volumes — Get-Volume | Where-Object DriveLetter — Check free space on source, destination and system volumes.
Disks — Get-PhysicalDisk | Select-Object FriendlyName,HealthStatus,OperationalStatus,Size — Review the disks exposed to Windows; confirm physical-device details in the storage vendor’s tools.
Shadow storage — vssadmin list shadowstorage — Inspect the current association and capacity before changing limits.
I/O — Compare Performance Monitor, storage-vendor tools and logs. Resolve confirmed storage errors before attempting a VSS reset.

Writer Failed — A specific writer is in the Failed state. Identify owning service/application before restart.
Timeout — A writer or provider did not respond in time. Check load, I/O, stuck services or concurrent backup.
Provider veto — The provider rejected the operation. Check third-party provider, storage and related events.
Insufficient space — Snapshot or shadow-copy storage cannot grow. Measure capacity before changing limits.

Application status — Check job success and critical warnings. A successful job with warnings can still leave a workload unprotected.
Size and duration — Compare with normal trends; unexpectedly small or short backups deserve investigation.
Backup chain — Check full/incremental dependencies. Do not manually delete chain members without understanding the recovery impact.
Restore — Test recovery to a safe location and validate the required files, permissions and application consistency.

Capture — Preserve writer/provider inventories and relevant events before a restart.
Identify the writer — Record its exact name and owning application. Use a targeted correction.
Check concurrency — Identify other backup or snapshot jobs running at the same time.
Rollback plan — Preserve recovery points and configuration before registry, COM+ or storage changes.

Avoid blanket VSS reset scripts as a first response.
Never delete all shadow copies without understanding restore/application impact.
Restore testing is the final validation of backup strategy.
VSS errors can be symptoms of storage, load or application problems.