Most file servers are configured to use the Windows internal shadow copies / VSS to allow administrators or even users to quickly restore files.
Microsoft allows you to extend the default maximum of 64 shadow copies to a total of up to 512 as described here: https://docs.microsoft.com/en-us/windows/desktop/Backup/registry-keys-for-backup-and-restore#maxshadowcopies
It is pretty easy to implement this – no restart needed (if running, restart the volume shadow copy service).
- HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\VSS\Settings
- MaxShadowCopies DWORD
- official maximum: 512 (decimal, NOT HEX!!!) (HEX: 0x200)
Now – we detected in January 2019 a bug that at least affects Windows 2016 servers, if not even more. We could not see the shadow copies of the current day. Any shadow copies of the previous day seemed to be fully available. The cut off was literally before midnight. After about 12 subsequent shadow copies they started to triple in.
Once we adjusted the maximum to 500 (decimal – HEX: 0x1f4) and restarting the service respective waiting till the next scheduled shadow copy executed (plus a few minutes to process a cleanup) we eventually could see the most current shadow copy from the Windows Explorer menu.
This seems to work way better then the 512 that is the defined maximum. There seems to be some kind of a bug that started with some update. We couldn’t determine it in detail and simulating this would take a lot of time.
NirSoft has a great tool to investigate your shadow copies as well here: http://www.nirsoft.net/utils/shadow_copy_view.html
This is a GUI based tool that partly lets you look in to your shadow copies. Only, if you try to open the most current paths while the 512 maximum was set, Windows Explorer still couldn’t handle it. But it was a nice detailed proof to see that the current shadow copies where as a matter of fact there.
Similar results could be determined while using PowerShell and command line commands like VSSadmin – we saw the shadow copies where there.
WMI provided the same information as well – for an example see the script here what uses WMI and PowerShell to gather information about shadow copies: https://www.it-admins.com/monitoring-shadow-copies-with-prtg/
Suggestions to configure shadow copies:
- set a maximum of 500 instead of 512
- do them e.g. hourly – as you need them
- this is all a calculation, straight hourly provides you 500 copies / 24 hours a day = +/- 20 days back
- if you go e.g. 5 AM to 9 PM and no Sundays you extend this: 500 / 17 snaps a day (hourly) = +/- 29 days => add the removed Sundays in the equation and you easily bypass a whole month
- this would allow you while doing full virtual machine backups (VHD level backups) to keep the month end tape of every month and still be able to restore files from the shadow copies in theory – I had cases where I had to dig that deep..
- volume configuration on your file servers (the drive letters don’t matter much)
- C: System – Windows OS etc.
- D: Data – this is where your shares resides – preferred DFS as described here
- E: Shadow Copies
- configure the shadow copies to be saved on their own volume / vhd / so they don’t take away space and you gain more control over how much space they actually can take
- configure them so they can use 100% of this separate volume
- do not use the volume for anything else (of course)
- Microsoft article about the steps involved: https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd364933(v=ws.10)
- add monitoring to your VSS – like described here with PRTG
