JSI Tip 9782. Windows XP NTBackup.exe issues a 'Volume Shadow Copy Service' error and the Application event log records Event ID 5013 or 12302?

When running NTBackup.exe to perform a backup, a restore, or a volume shadow copy, you receive an error like:

Volume Shadow Copy Service error: Shadow Copy writer ContentIndexingService called routine RegQueryValueExW which failed with status 0x80070002 (converted to 0x800423f4)

The Application event log records an event similar to one of the following:

Event Type: Error
Event Source: VSS
Event Category: None
Event ID: 5013
Date: MM/DD/YYYY
Time: HH:MM:SS
User: N/A
Computer:
Description: Volume Shadow Copy Service error: Shadow Copy writer ContentIndexingService called routine RegQueryValueExW which failed with status 0x80070002 (converted to 0x800423f4). For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data: 0000: 57 53 48 43 4f 4d 4e 43 WSHCOMNC 0008: 32 32 39 32 00 00 00 00 2292.... 0010: 57 53 48 43 49 43 00 00 WSHCIC.. 0018: 32 38 37 00 00 00 00 00 287.....

Event Type: Error
Event Source: VSS
Event Category: None
Event ID: 12302
Date: MM/DD/YYYY
Time: HH:MM:SS
User: N/A
Computer:
Description: Volume Shadow Copy Service error: An internal inconsistency was detected in trying to contact shadow copy service writers. Please check to see that the Event Service and Volume Shadow Copy Service are operating properly. For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

The behavior is indicative of a missing Location Value Name in one or more sub-keys of HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlContentIndexCatalogs. This problem is generally the result of a program uninstall deleting the Location Value Name instead of the entire sub-key.

NOTE: The default sub-keys, and their Value Names, are:

HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlContentIndexCatalogsSystem    Location    REG_SZ  C:System Volume Information    IsIndexingW3Svc     REG_DWORD       0x0    IsIndexingNNTPSvc   REG_DWORD       0x0HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlContentIndexCatalogsweb    Location    REG_SZ  c:inetpub    IsIndexingW3Svc     REG_DWORD       0x1    IsIndexingNNTPSvc   REG_DWORD       0x0    W3SvcInstance       REG_DWORD       0x1    GenerateCharacterization    REG_DWORD       0x1    FilterFilesWithUnknownExtensions    REG_DWORD       0x0    MaxCharacterization REG_DWORD       0x140

I have scripted CILoc.bat to list any sub-keys that have a missing Location Value Name. The syntax for using CILoc.bat is:

CILoc [ComputerName]

Where ComputerName is an optional NetBIOS computer name. If missing, the local computer is checked.

CILoc.bat contains:

@echo offsetlocal ENABLEDELAYEDEXPANSIONset comp=%computername%if {%1} NEQ {} set comp=%1set comp=%comp:"=%set comp=\%comp:=%set key=HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlContentIndexCatalogsfor /f "Tokens=*" %%a in ('REG QUERY %comp%%key% ^|find /i "%key%"') do ( set wrk1=%%a call set wrk2=!wrk1:%key%=! set OK=N for /f "Tokens=1" %%x in ('REG QUERY %comp%!wrk1! /V Location^|find /i "Location"') do set OK=Y if "!OK!" EQU "N" @echo Location missing: %comp%%%a)endlocal

If a sub-key with a missing Location is listed, delete the sub-key if the program has been uninstalled. If the program is installed, use Regedit.exe to add the Location Value Name, a REG_SZ data type, with the correct folder path.