Event ID 8194: IVssWriterCallback access denied

For our backup infrastructure, we use a backup technology that supports both volume shadow copies and deduplication. The VSS driver (volume shadow copy driver) is used here. This is operated under Windows Server 2016, Windows Server 2019 and Windows Server 2022 as a VSS service.

Error analysis

Under certain circumstances, the Windows Server environment crashes during server operation, regardless of the pending or running backup tasks. After a restart, the following error is logged in the event log:

Event ID 8194

Volume shadow copy service error:

An unexpected error occurred while querying for the "IVssWriterCallback" interface.
hr = 0x80070005, access denied.

This is often caused by an incorrect security setting in the write or request process.

Troubleshooting

To permanently resolve this error, it is necessary to grant the Windows network service permissions for local COM security.

Open the Component Services via the search or the mmc command.

Then select the menu item Console root → Component services → Computer. Right-click on the My Computer icon to access the required properties.

Navigate to the COM Security tab and select the Edit default... button in the access permissions area.

You can then view the previous group or user names with existing authorizations. If the network service has already been authorized here with the Local access (Allow) authorization, no further adjustment is necessary.

If the Network service user has not yet been mapped, add it using the Add... button. You can search for and add the Network service user using the search function. The list of authorizations should then be displayed as follows:

Once the user has been authorized for local access, the error caused by the missing permissions is resolved. A restart of the Windows server is not necessary in this case, as the updated authorizations take effect immediately.