Destroyed the Volume Shadow Copy Service for an Entire Domain

▲
0
▼

So I decided to add users to the Backup Operators group to all computers in the Domain by editing the default domain policy and adding a restricted group. I also set the Volume Shadow copy to start as part of the default domain policy as well.

One of these two changes seems to have made it so Volume shadow copy will no longer start on any computers in the domain.

I tried undoing both these changes, force pushing the changes with gpupdate, and then restarting the computer. But the service still won't start, I get error:

Windows Could not Start the Volume Shadow Copy Service ... 
refer to service specific error code -2147467243

All I get in the event log is:

Volume Shadow Copy Service initialization error: the COM classes cannot be registered [0x80004015]
windows-server-2003
group-policy
vss
asked on Server Fault Aug 27, 2009 by Kyle Brandt • edited Jan 19, 2011 by sysadmin1138

2 Answers

▲
1
▼

I always assume that my GP changes won't take effect until I gpupdate/force or reboot. Or reboot twice. I think in the worst case, the policy doesn't get updated till the first reboot, and then can't apply til the second. Yet some machines/policies will update at the set interval (90 min default, Computer Configuration\Administrative Templates\System\Group Policy\Group Policy refresh interval for computers).

I know it's not really random, but it feels like it.

answered on Server Fault Aug 28, 2009 by Kara Marfia
▲
1
▼

The changes do seem to have propagated without the reboot. So I a had to do was revert the changes, I think it was telling the Volume Shadow Copy service to start at boot that broke it, but I am not sure. A reboot doesn't seem to be required, I will edit this if over time some of the machiens did need to be rebooted.

This has changed my philosophy for how I am going to handle my Window's administration. My new approach is going to be that unless I find an article that says doing exactly what I am going to do will work, I am not going to touch it. I just find that this stuff sucks to much to expect things that logically should work have a decent chance of working. Either that or my knowledge of AD is just not good enough, I do have to leave room for that possibility..

I generally avoid rants, but this frustrated me, and it was my own question ;-).

answered on Server Fault Aug 28, 2009 by Kyle Brandt

User contributions licensed under CC BY-SA 3.0