This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(208, 16%, 30%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EDK%3C/text%3E%3C/svg%3E)
Windows 11 Pro 25H2
OS build 26200.7840
Issue Description
Volume Shadow Copy Service (VSS) fails to create snapshots on the system drive (C:). System Restore hangs indefinitely.
Manual snapshot creation using WMIC either hangs or returns ReturnValue = 9. In some cases, the operation times out.
Observed Errors
Event Viewer logs contain the following entries:
VSS Event ID 12289
volsnap Event ID 67
volsnap Event ID 30
Reported error code:
0x80070079 — The semaphore timeout period has expired.
The snapshot process stalls during the EndPrepareSnapshots phase.
System State Verification
The system integrity was verified:
DISM RestoreHealth completed successfully. SFC reported no integrity violations. CHKDSK scan reported no file system errors.
VSS Configuration
All VSS writers report Stable state. Shadow storage configuration is valid. Shadow storage was resized to 30 GB on volume C:. The Microsoft Software Shadow Copy Provider is used.
Service State During Testing
During reproduction of the issue, the following services were fully stopped and confirmed as stopped:
AppXSVC (AppX Deployment Service) ClipSVC (Client License Service) InstallService (Microsoft Store Install Service)
No AppXDeploymentServer or wsappx processes were running at the time of testing.
Active Minifilter Drivers
While reproducing the issue, the following minifilter drivers were loaded:
mrigflt WdFilter gameflt
No third-party antivirus or filter drivers are present. Previously installed third-party security software was fully removed.
Storage State
The system volume uses NTFS. Disk health is normal. Sufficient free space is available. No I/O or SMART errors are reported.
Reproducibility
The issue is consistently reproducible when attempting to create a shadow copy of volume C:.
Request for Assistance
We request analysis of the root cause of the VSS snapshot failure under the described conditions and guidance on how to restore normal VSS functionality.
Please advise on any additional diagnostics, logs, or data required to proceed with investigation.
VSS verbose logging is enabled (Verbose = 1), all VSS diagnostic subkeys are present, and the VSS log directory exists.
After reproducing the issue, no VSS.log file is generated in any location.
This indicates the failure occurs before user-mode VSS logging is reached.
Please advise on the next-level diagnostics to collect (for example, volsnap or kernel/storage ETW tracing), or escalate this case to the appropriate Windows client storage / VSS engineering team.
