Q. When you import a transportable snapshot in Windows Server 2003 the System event log records Event ID 27?

When you import a transportable snapshot in Windows Server 2003 the System event log records:

Type: error
Source: VolSnap
Category: n/a
Event ID: 27
Description: The shadow copy of volume X: could not be created due to a failure in opening the critical control files
Data
0000: 00000000 00580002 00000000 C006001B
0008: 00000001 C0000121 00000000 00000000
0010: 00000000 0000000

This behavior occurs when you import a transportable snapshot that is set to read-only, causing the volume that the transportable snapshot contains to be read-only. Volsnap.sys (the Volume Shadow Copy Service driver) does not distinguish a differential software shadow copy from a read-only volume, and tries to remove the differential software shadow copy in the transportable snapshot. The event is logged when Volsnap.sys cannot remove the differential software shadow copy.

This event can be safely ignored.