I had a set of Windows 2008R2 servers today that were having trouble backing up the system state via Windows Server Backup – they would fail with the error “System writer is not found in the backup”. I scoured the ‘net and talked to colleagues, and all of the resolutions I could find involved re-registering components, re-securing things in the Cryptography Service (prompted by CAPI or CryptSvc errors in the event log), setting ownership on WinSXS folders, etc. I did not have any such errors in my logs to indicate a permissions issue – in fact, I saw no errors at all (usually good – not so much when something is broken!). However, every time I ran “vssadmin list writers”, indeed the system writer was missing.
After taking a procmon, I noticed that the last thing that was searched were some setupapi.ev* files in \Windows\Inf:
I decided, on a whim, to replace these files with files from another server I had that was working – I stopped the VSS and CryptSvc services (the system writer is part of CryptSvc, so says Microsoft), and copied the three setupapi.ev* files from a working server to one that wasn’t. I then restarted the CryptSvc and VSS services, and ran vssadmin list writers – lo and behold, the System Writer was back! Procmon looked very different too:
Of course, once I knew what was broken, finding out how to fix this became easy. I hate when that happens…