VSS Error: Illegal operation attempted on a registry key that has been marked for deletion.


When doing a backup either via the agent or application aware, you may be presented with this error


When doing a backup of a 2008 server using AppAware configurations on a VMWare host, you may be presented with one of the following errors:

In Unitrends Backup Messages UI Screen (appaware VMware):
Failed to run vss snapshot create program in guest. Error 0x1, VSS program returns error 0x80004005

Windows Event Logs inside 2008 guest:
Volume Shadow Copy Service information: The COM Server with CLSID {e579ab5f-1cc4-44b4-bed9-de0991ff0623} and name IVssCoordinatorEx2 cannot be started. [0x800703fa, Illegal operation attempted on a registry key that has been marked for deletion.

   Instantiating VSS server

Volume Shadow Copy Service error: Unexpected error calling routine CoCreateInstance.  hr = 0x800703fa, Illegal operation attempted on a registry key that has been marked for deletion.

   Instantiating VSS server


Option 1)  (preferred)
Configure AppAware credentials to use a Windows Service Account for authentication instead of a domain user that is likely to individually log on/off the system in question.  This will prevent this issue present in 2008 servers from materializing entirely. Use of service accounts that do not auto-expire passwords and that do not get changes as staff may change is a best practice to ensure that backup systems are not negatively impacted by day-to-day Active Directory changes.  

Option 2)  Disable the related Windows User Profile Service feature. To do this, follow these steps:

  1. Open the Group Policy editor (Gpedit.msc) on the affected server.
  2. Open the UserProfiles folder in the following path:

    Computer Configuration > Administrative Templates > System > UserProfiles
  3. Locate the Do not forcefully unload the user registry at user logoff setting.
  4. Change the setting to Enabled.


This problem typically occurs after an administrator uses a service account to log on to the server for an interactive session, and then logs off. For example, an administrator may log on during appaware to run VSS commands and then log off. This activity forces the registry keys to be unloaded in the profile of that account. This condition makes the keys unavailable for future use.

This may occur on Windows 2008 VMs in VMWare where appaware backups were used where the appaware credential user may have encountered the issue described in Microsoft KB01388.   To avoid this issue, configure appaware to use service accounts with logon as a service right to login to Windows and not domain users, and also to avoid other issues, set the password to not expire for those service accounts.



Have more questions?

Contact us

Was this article helpful?
0 out of 0 found this helpful

Provide feedback for the Documentation team!

Browse this section