Issue

System Writer missing

Applies to Windows Sever Operating System on physical and virtual machine

Symptoms

• In “vssadmin list writers” output, System Writer is missing

• VSS backup failed with error “Volume Shadow Copy Service error: An internal inconsistency was detected in trying to contact shadow copy service writers“

• Multiple Service terminated unexpectedly (svchost.exe process crashed)

• Impacted Service:

COM+ Event System service terminated unexpectedly.

Windows Font Cache Service service terminated unexpectedly

Network List Service service terminated unexpectedly

Network Store Interface Service service terminated unexpectedly

W32Time Service service terminated unexpectedly

Error in System Logs:

Log Name: System

Source: Service Control Manager

Event ID: 7031

Task Category: None

Level: Error

Keywords: Classic

Description:

The COM+ Event System service terminated unexpectedly.

• Ran following command to validate SVCHOST container for above services and that all the affected services are running in same container with Process ID: 1304.

tasklist /svc /fi "imagename eq svchost.exe 

Service Display Name                                   Service Name

COM+ Event System service                       EventSystem

Windows Font Cache Service                     FontCache

Network List Service                                    Netprofm

Network Store Interface Service                  NSI

W32Time Service                                          W32Time

Cause:

One of the Services (COM+ Event System service, Windows Font Cache Service, Network List Service, Network Store Interface Service, W32Time Service) running in the svchost.exe (Process ID: 1304) failed causing svchost.exe to terminate and restart.

Solution

• Run each service in separate container

sc config ‘servicename’ type= own

We have only removed W32Time from svchost.exe container and W32Time is running in separate container

• Run W32Time Service separate container

sc config W32Time type= own