# VSS errors with endpoint

**URL:** <https://discuss.elastic.co/t/vss-errors-with-endpoint/323533>\
**Category:** Elastic Security\
**Created:** [January 19, 2023, 5:43pm UTC](https://discuss.elastic.co/t/vss-errors-with-endpoint/323533 "2023-01-19T17:43:47Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![yak990](https://avatars.discourse-cdn.com/v4/letter/y/c68b51/32.png) [@yak990](https://discuss.elastic.co/u/yak990)\
**Post date:** [January 19, 2023, 5:43pm UTC](https://discuss.elastic.co/t/vss-errors-with-endpoint/323533/1 "2023-01-19T17:43:47Z")

</div>

I get the error below in my application event log several times a minute at times if the endpoint features are enabled. It's a conflict with macrium reflect.

To reproduce:  
Install free trial of macrium: [Macrium Software | Macrium Reflect Free Trial](https://www.macrium.com/reflectfree#) Be sure to enable image guardian on the install.  
Enable all the standard protections in the elastic defend policy.

Thanks!

Volume Shadow Copy Service error: Unexpected error querying for the IVssWriterCallback interface. hr = 0x80070005, Access is denied.  
. This is often caused by incorrect security settings in either the writer or requestor process.

Operation:  
Gathering Writer Data

Context:  
Writer Class Id: {e8132975-6f93-4464-a53e-1050253ae220}  
Writer Name: System Writer  
Writer Instance ID: {cbd80fb4-1a49-467b-84fc-adcaae97be0c}

---

<div class="post-metadata">

**Author:** ![gabriel.landau](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gabriel.landau/32/73401_2.png) [@gabriel.landau](https://discuss.elastic.co/u/gabriel.landau)\
**Post date:** [January 19, 2023, 10:21pm UTC](https://discuss.elastic.co/t/vss-errors-with-endpoint/323533/2 "2023-01-19T22:21:49Z")

</div>

Hi @yak990,

Thanks for reaching out.

First thing, it doesn't sound like the same issue, but I want to let you know that 8.6.0 fixes an issue with **Cluster Shared Volume VSS Writer** generating **Event ID 1544** , however that is reproducible without Macrium. If Macrium is required to reproduce the problem in your environment, or you are already running 8.6.0, then you are likely encountering a different issue.

Now on to Macrium:

> [@yak990](#):
>
> Be sure to enable image guardian on the install.

From [their website](https://www.macrium.com/reflectfree#):

> Macrium Image Guardian ensures that backup files created through the Reflect engine are always safe from unauthorized modifications

It sounds like Macrium is blocking access to Volume Shadow Copies. That will conflict with Endpoint's [rollback self-healing](https://www.elastic.co/guide/en/security/8.6/self-healing-rollback.html) feature, which maintains a handful of shadow copies. The first thing I would look for is a way to add **C:\Program Files\Elastic\Endpoint\elastic-endpoint.exe** as an exception to Macrium. If that's not possible, you can try disabling rollback by setting **windows.advanced.diagnostic.rollback\_telemetry\_enabled** to **false** in [advanced policy](https://www.elastic.co/guide/en/security/7.17/configure-endpoint-integration-policy.html#adv-policy-settings).

If you are a Platinum or Enterprise user and are using the rollback self-healing feature, you will need to disable it to avoid this error. You can do that by clearing the **windows.advanced.alerts.rollback.self\_healing.enabled** field, restoring its default-disabled state.

Please let us know how things go.

Regards,  
Gabriel

---

<div class="post-metadata">

**Author:** ![yak990](https://avatars.discourse-cdn.com/v4/letter/y/c68b51/32.png) [@yak990](https://discuss.elastic.co/u/yak990)\
**Post date:** [January 20, 2023, 6:55pm UTC](https://discuss.elastic.co/t/vss-errors-with-endpoint/323533/3 "2023-01-20T18:55:18Z")

</div>

Thanks for the explanation. I ended up disabling image guardian, because you can't create exceptions for it. The idea is to keep everything out of the backup files, including antivirus software.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 17, 2023, 6:56pm UTC](https://discuss.elastic.co/t/vss-errors-with-endpoint/323533/4 "2023-02-17T18:56:06Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.