%3CLINGO-SUB%20id%3D%22lingo-sub-259112%22%20slang%3D%22en-US%22%3EWindows%20Backups%20Failing%20with%20Associated%20VSS%208193%20Errors%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-259112%22%20slang%3D%22en-US%22%3E%3CP%3E%3CSTRONG%3EFirst%20published%20on%20TechNet%20on%20Jul%2031%2C%202017%20%3C%2FSTRONG%3E%20%3CBR%20%2F%3EHi%2C%20this%20is%20Michael%20Koeppl%20again.%20I%E2%80%99m%20with%20the%20Premier%20Mission%20Critical%20(PMC)%20Team%20and%20assisting%20customers%20when%20they%20hit%20OS%20issues%20in%20their%20critical%20infrastructure%2C%20and%20today%20I%20wanted%20to%20talk%20with%20you%20about%20an%20interesting%20Windows%20Backup%20issue%20I%20encountered.%20My%20customer%20realized%20that%20his%20System%20State%20Backups%20(%20%3CA%3E%20https%3A%2F%2Ftechnet.microsoft.com%2Fen-us%2Flibrary%2Fcc938537.aspx%20%3C%2FA%3E%20)%20on%20one%20of%20his%20DCs%20stopped%20working%20and%20asked%20if%20I%20could%20have%26nbsp%3B%20a%20look.%20In%20the%20Application%20Event%20Log%20was%20a%20prominent%20VSS%20error%20saying%20something%20about%20a%20%3CSTRONG%3E%20ConvertStringSidToSid%20%3C%2FSTRONG%3E%20function%20which%20failed.%20%3CA%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20713px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F53297iB7E60F623026BBD5%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20%2F%3E%3C%2FSPAN%3E%3C%2FA%3EHere%E2%80%99s%20the%20original%20text%20for%20better%20searchability%3A%20Log%20Name%3A%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%20Application%20Source%3A%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%20VSS%20Date%3A%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%2027.06.2017%2021%3A00%3A21%20Event%20ID%3A%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%208193%20Task%20Category%3A%20None%20Level%3A%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%20Error%20Keywords%3A%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%20Classic%20User%3A%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%20N%2FA%20Computer%3A%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%20MYcomputer.anydomain.net%20Description%3A%20Volume%20Shadow%20Copy%20Service%20error%3A%20Unexpected%20error%20calling%20routine%20ConvertStringSidToSid(S-1-5-21-2828234547-00000000000-1509355905-1125.bak).%26nbsp%3B%20hr%20%3D%200x80070539%2C%20The%20security%20ID%20structure%20is%20invalid.%20Operation%3A%20OnIdentify%20event%20Gathering%20Writer%20Data%20Context%3A%20Execution%20Context%3A%20Shadow%20Copy%20Optimization%20Writer%20Writer%20Class%20Id%3A%20%7B4dc3bdd4-ab48-4d07-adb0-3bee2926fd7f%7D%20Writer%20Name%3A%20Shadow%20Copy%20Optimization%20Writer%20Writer%20Instance%20ID%3A%20%7B74a61a33-665e-4041-b325-726825b2bf8e%7D%20This%20was%20followed%20by%20a%20521%20Event%20from%20Windows%20Backup%20telling%20you%20that%20the%20Backup%20operation%20failed.%20%3CA%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20664px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F53298iAB5449D089F3F387%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20%2F%3E%3C%2FSPAN%3E%3C%2FA%3EWhy%3F%20The%20hint%20was%20already%20in%20the%20event%20details%20from%20the%20VSS%20error%3A%20ConvertStringSidToSid(S-1-5-21-2828234547-00000000000-1509355905-1125.%20bak%20)%20Can%20you%20spot%20the%20SID%20with%20the%20BAK%20extension%20at%20the%20end%3F%20So%20we%20looked%20at%20the%20ProfileList%20regkey%20on%20that%20machine.%20HKEY_LOCAL_MACHINE%5CSOFTWARE%5CMicrosoft%5CWindows%20NT%5CCurrentVersion%5CProfileList%20And%20here%20it%20is%3A%20%3CA%3E%20%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20840px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F53299i0EE661DAE4EE3CE9%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20%2F%3E%3C%2FSPAN%3E%20%3C%2FA%3E%20We%20followed%20this%20KB%20(947215)%20and%20ultimately%20removed%20the%20Profile%20with%20the%20BAK%20extension%20and%20started%20another%20Windows%20SystemState%20Backup%2C%20which%20succeeded%20without%20any%20errors.%20The%20User%20Profile%20Service%20failed%20the%20logon.%20User%20profile%20cannot%20be%20loaded%20%3CA%20href%3D%22http%3A%2F%2Fsupport.microsoft.com%2Fkb%2F947215%2Fen-us%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Ehttp%3A%2F%2Fsupport.microsoft.com%2Fkb%2F947215%2Fen-us%3C%2FA%3E%20Here%E2%80%99s%20an%20automated%20way%20to%20clean%20up%20the%20old%20profiles%20from%20that%20list.%20Script%20to%20fix%20issues%20described%20in%20KB947215%20(PowerShell)%20%3CA%20href%3D%22https%3A%2F%2Fgallery.technet.microsoft.com%2Fscriptcenter%2FScript-to-fix-issues-ab65f43e%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Ehttps%3A%2F%2Fgallery.technet.microsoft.com%2Fscriptcenter%2FScript-to-fix-issues-ab65f43e%3C%2FA%3E%20Hope%20you%20enjoyed%20the%20quick%20excursion%20from%20VSS%20to%20profiles%20with%20an%20easy%20solution%20at%20the%20end.%20Greetings%2C%20Michael%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-TEASER%20id%3D%22lingo-teaser-259112%22%20slang%3D%22en-US%22%3E%3CP%3EFirst%20published%20on%20TechNet%20on%20Jul%2031%2C%202017%20%26nbsp%3B%20Hi%2C%20this%20is%20Michael%20Koeppl%20again.%3C%2FP%3E%3C%2FLINGO-TEASER%3E%3CLINGO-LABS%20id%3D%22lingo-labs-259112%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EMichaelKoeppl%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E
Microsoft

First published on TechNet on Jul 31, 2017
Hi, this is Michael Koeppl again. I’m with the Premier Mission Critical (PMC) Team and assisting customers when they hit OS issues in their critical infrastructure, and today I wanted to talk with you about an interesting Windows Backup issue I encountered. My customer realized that his System State Backups ( https://technet.microsoft.com/en-us/library/cc938537.aspx ) on one of his DCs stopped working and asked if I could have  a look. In the Application Event Log was a prominent VSS error saying something about a ConvertStringSidToSid function which failed. Here’s the original text for better searchability: Log Name:      Application Source:        VSS Date:          27.06.2017 21:00:21 Event ID:      8193 Task Category: None Level:         Error Keywords:      Classic User:          N/A Computer:      MYcomputer.anydomain.net Description: Volume Shadow Copy Service error: Unexpected error calling routine ConvertStringSidToSid(S-1-5-21-2828234547-00000000000-1509355905-1125.bak).  hr = 0x80070539, The security ID structure is invalid. Operation: OnIdentify event Gathering Writer Data Context: Execution Context: Shadow Copy Optimization Writer Writer Class Id: {4dc3bdd4-ab48-4d07-adb0-3bee2926fd7f} Writer Name: Shadow Copy Optimization Writer Writer Instance ID: {74a61a33-665e-4041-b325-726825b2bf8e} This was followed by a 521 Event from Windows Backup telling you that the Backup operation failed. Why? The hint was already in the event details from the VSS error: ConvertStringSidToSid(S-1-5-21-2828234547-00000000000-1509355905-1125. bak ) Can you spot the SID with the BAK extension at the end? So we looked at the ProfileList regkey on that machine. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList And here it is: We followed this KB (947215) and ultimately removed the Profile with the BAK extension and started another Windows SystemState Backup, which succeeded without any errors. The User Profile Service failed the logon. User profile cannot be loaded http://support.microsoft.com/kb/947215/en-us Here’s an automated way to clean up the old profiles from that list. Script to fix issues described in KB947215 (PowerShell) https://gallery.technet.microsoft.com/scriptcenter/Script-to-fix-issues-ab65f43e Hope you enjoyed the quick excursion from VSS to profiles with an easy solution at the end. Greetings, Michael