Server 2012 - VSS Event ID 8194 - Unexpected error querying for the IVssWriterCallback interface. hr = 0x80070005 Access is denied

Question

I'm seeing an error popping up in the application log on both nodes of my Server 2012 cluster.  The events seem to occur when DPM begins a system state/bmr backup of the node.  The DPM Backups usually complete successfully, but over the course
of a sync or consistency check this event might appear 8-10 times in the application log of the cluster node.  The event reads:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="VSS" />
<EventID Qualifiers="0">8194</EventID>
<Level>2</Level>
<Task>0</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2013-05-13T05:15:50.000000000Z" />
<EventRecordID>11424</EventRecordID>
<Channel>Application</Channel>
<Computer>node1.domain.com</Computer>
<Security />
</System>
<EventData>
<Data>0x80070005, Access is denied.
</Data>
<Data>
Operation:
Gathering Writer Data
Context:
Writer Class Id: {e8132975-6f93-4464-a53e-1050253ae220}
Writer Name: System Writer
Writer Instance ID: {c9b83054-b318-4486-a5aa-6c36b591b3f8}</Data>
<Binary>2D20436F64653A20575254575254494330303030313330302D2043616C6C3A20575254575254494330303030313235342D205049443A202030303030313631362D205449443A202030303031353238382D20434D443A2020433A5C57696E646F77735C73797374656D33325C737663686F73742E657865202D6B204E6574776F726B53657276696365202020202020202D20557365723A204E616D653A204E5420415554484F524954595C4E4554574F524B20534552564943452C205349443A532D312D352D3230</Binary>
</EventData>
</Event>
If I run 'vssadmin list writers' after the backup job completes, all writers report their state as stable with no errors.  
I came across this error recently when trying to troubleshoot another issue, but looking back, I can see that these have been going on for a while.  The first instance I see occurred in early March.  
Any suggestions on what I can do to clear up this error?

Answer 1

Please checked the ACLs:
Takeown /f %windir%\winsxs\temp\PendingRenames /a
icacls %windir%\winsxs\temp\PendingRenames /grant "NT AUTHORITY\SYSTEM:(RX)"
icacls %windir%\winsxs\temp\PendingRenames /grant "NT Service\trustedinstaller:(F)"
icacls %windir%\winsxs\temp\PendingRenames /grant BUILTIN\Users:(RX)
Takeown /f %windir%\winsxs\filemaps\* /a
icacls %windir%\winsxs\filemaps\*.* /grant "NT AUTHORITY\SYSTEM:(RX)"
icacls %windir%\winsxs\filemaps\*.* /grant "NT Service\trustedinstaller:(F)"
icacls %windir%\winsxs\filemaps\*.* /grant BUILTIN\Users:(RX)
net stop cryptsvc
net start cryptsvc
Then please verified:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS\VssAccessControl
NT AUTHORITY;NETWORK SERVICE;LOCAL SERVICE are set to 1
TechNet Subscriber Support in forum |If you have any feedback on our support, please contact [email protected]