VSS Snapshot warning. (Files) is not present on the snapshot.

[Alan_Levy]

I have been getting the following errors every night while running my backup job on my SBS 2008 server, using version 12.5.  There are five specific files which have the following errors:

VSS Snapshot warning. File c:\windows\system32\vmnetdhcp.exe is not present on the snapshot.
VSS Snapshot warning. File c:\windows\inf\oem12.inf is not present on the snapshot.
VSS Snapshot warning. File c:\windows\inf\oem13.inf is not present on the snapshot.
VSS Snapshot warning. File c:\windows\inf\oem14.inf is not present on the snapshot.
VSS Snapshot warning. File c:\windows\system32\vmnat.exe is not present on the snapshot.

Does anyone have any suggestions as to how to fix or correct the issue?

Thanks,

Alan

[Kevin_Cotreau]

A lot of people have this error, although with various different files not being on the snapshot. If this procedure works for you, please have the courtesy to post back saying it worked or did not work so it can help the others.

File>Export the following key to your desktop to back it up:

HKEY_CURRENT_USER\Software\Microsoft\EventSystem\{26c409cc-ae86-11d1-b616-00805fc79216}\Subscriptions

Delete that key and reboot the server.

At a command prompt, to rebuild that key you removed, run this command: vssadmin list writers

Run that command again and make sure that it comes back reporting no errors.

[Alan_Levy]

Kevin,

I did as you suggested and deleted the key, rebooted and ran the command. The command ran with no errors reported.  The only issue I can see is I checked back via Regedit and the Subscriptions sub-path did not get re-created the only path that is reporting is the root:

HKEY_CURRENT_USER\Software\Microsoft\EventSystem\{26c409cc-ae86-11d1-b616-00805fc79216}\

With nothing under it, is this normal or does some other action need to be taken?

Regards,

Alan

[Kevin_Cotreau]

You deleted JUST the subscriptions key, right, not at the {26c409cc-ae86-11d1-b616-00805fc79216} level?

If you did, and it did not recreate the subscriptions key (it was my understanding that it would), I would try my backup and see how it goes. If it does not work for any reason, you can always restore the key you saved to the desktop and reboot.

Also check the subscriptions key after you run a backup to see if that recreated it. I will test it later on a virtual server too and post back.

[Alan_Levy]

Correct I only deleted subscriptions, and below.  It seems like all it was needed was time, I just checked again and the subscriptions and below were re-created.  I am kicking off a backup job and will report back once that completed.

Regards,

Alan

[Kevin_Cotreau]

Glad to hear it was recreated. I can't wait for the results of your backup. I hope it fixed the problem, because if so, there are a lot of other people who will be happy too.

[Alan_Levy]

kevin,
sorry to report but the fix did not work.

the backup job completed with the same errors present.

regards,
alan

[Kevin_Cotreau]

Have you tried creating a new selection list and associating it with the job? This is easier than recreating the whole job.

[Alan_Levy]

I tried several backup jobs today\night.  The backup job that causes the error specifically is when system state is being backed up.  Just backing up the C:\ partition with VSS does not cause the error to occur.  I think I am a bit farther along, but the problem is not solved anyone have any other suggestions?

Thanks,

Alan

[Kevin_Cotreau]

Have you tried creating a new job with just the System State? Not only can you run that test quickly, but it will tell you if it is related to your original, current job.

I am also going to send you a private message.

[Alan_Levy]

Kevin,

Yes, new jobs were created for ever test that I ran tonight along with new selection lists.  I am replying back to your PM as well.

Regards,

Alan

[moto822]

Hi Guys,

I am having this exact same issue on a few different servers. I went to this reg key and I don't have any subkeys under the {26c409cc-ae86-11d1-d616-00805fc79216}. I also tried running that script to see if it would add the key with no success. Is there something I could be missing?

[lindblom]

Same problem here also.  I think it's from a failed or at least a uninstall of TrenMicro Officescan client.  I have two servers that I built at the same time one has OEM13 - OEM16.inf files that belong to the Officescan client and all OEMx.inf files in the C:\Windows\Inf directory are in sequence and no errors with the SystemState backup.

The server with the errors indicating OEM14.inf and OEM15.inf files are missing actually are missing from the directory. OEM13.inf is still there and it is from Officescan.  The thing is I uninstalled Officescan at one time and reinstalled it and it created OEM17-OEM19.inf so it appears the OEM13.inf was left behind.  Something is obviously still referencing the two OEM files but what.

This is no answer to the problem, I'm still trying to solve this but something to possibly go on.

[dvdb]

Had same issue with BE12.5 and SBS2008 with VMware Server 2.0

VSS Snapshot warning. File c:\windows\system32\vmnetdhcp.exe is not present on the snapshot.

VSS Snapshot warning. File c:\windows\system32\vmnat.exe is not present on the snapshot.

Exclusion in backup Job didn't solve the problem.

Files aren't located in c:\Windows\system32

Taskmanager showed that the exes (services) were started from c:\Windows\SysWOW64 folder.

Properties of service showed c:\Windows\system32 as path

Changed the path for these services in registry:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VMware NAT Service\ImagePath = C:\Windows\SysWoW64\vmnat.exe

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VMnetDHCP = C:\Windows\SysWOW64\vmnetdhcp.exe

Restarted these services.

Backup of system state completed without errors.

I think that backup of system state backups the files where services refer to in the registry. But for VMware DHCP and NAT service, it didn't find the files at windows\system32, so its not present in the snapshot

[lindblom]

I found my problem is related to a problem I had installing Trendmicro Officescan on this Server 2008 DC.  The C:\Windows\inf directory is missing oem14.inf and oem15.inf and not completely sure what is going on.

I uninstalled Officescan but it left a OEM13.inf file in C:\Windows\inf, I can verify that by opening the file.  I think the initial failed install used OEM13-15 but now when I reinstall it creates OEM17-19.  I need to figure out how to remove the OEM13.inf and any reference to OEM14-15 so they can be reused or at least considered not used by the OS.

Any idea how to cleanup OEM files?

[MrWizard]

I do not know if you have fixed your problem, but I am experiencing the same issues. But I also found this document on symantec http://seer.entsupport.symantec.com/docs/303664.htm which states that is a known issue and also a non issue (you can ignore the message). Futhermore the article states that symantec is working on a fix....

[metvanitmgr]

dvdb's post above had it right.  One thing of note.  In our case the failing server (producing the error in BE) has VMWare installed on it and it is a MS 2008 server.  I made the recommended changes on it from dvdb's post above.  I then restarted the NAT and DHCP VMWare services on that server and Voila!  no more errors.  Thanks for the tip!  Hard to believe Symantec hasn't resolved this issue.  Such a easy and quick fix.  Thanks again dvdb!!!