Event ID 8194: IVssWriterCallback Access Denied

For our backup infrastructure, we use a backup technology that supports both volume shadow copies and deduplication. This is where the VSS driver (Volume Shadow Copy Service driver) comes into play. On Windows Server 2016, Windows Server 2019, and Windows Server 2022, it runs as a VSS service.

Error Analysis

Under certain circumstances, the Windows Server environment may crash during server operation, regardless of any pending or running backup tasks. After a restart, the following error is logged in the event log:

Event ID 8194

Volume Shadow Copy Service error: 

An unexpected error occurred while querying the "IVssWriterCallback" interface. 
hr = 0x80070005, Access Denied. 

This is often caused by an incorrect security setting in the write or query process.

Troubleshooting

To permanently resolve this error, you must grant the Windows Network Service permissions for local COM security.

Open Component Services via Search or the mmc command.

Then select the menu item Console Tree → Component Services → Computer. Right-click the My Computer icon to access the required properties.

Navigate to the COM Security tab and select the Edit Default... button in the Access Permissions section.

You can then view the existing group or user names with their current permissions. If the Network Service has already been authorized here with the Local Access (Allow) permission, no further adjustments are necessary.

If the Network Service user is not yet listed, add it using the Add… button. You can search for the Network Service user and add it. The list of permissions should then appear as follows:

Once the user has been authorized for local access, the error caused by the missing permissions is resolved. Restarting the Windows Server is not necessary in this case, as the updated permissions take effect immediately.