Windows 10: Volsnap Event 36 "Shadow Copies were aborted due to user imposed limit" Confusion

I checked Event Viewer System logs and found a Volsnap error event with ID 36, stating that the shadow copies of my drive were aborted due to a user imposed limit. I filtered the log but that was the only instance of this event that has occurred I'm not sure what this user imposed limit means, since I don't use or tinker with System Restore, it just runs because it was enabled by default. I'm not running out of disk space because I still have 1.4tb free, I have no external hard drives, and I ran a chkdsk for bad sectors, of which there were 0secondly, I clicked the Details tab of the error eve

:)

 

"Shadow Copies of volume C: aborted" (Event ID 36)...

I did not see anything obviously wrong with my registry entries for volsnap and enum. Below are screen clips of registry and my system properties showing protection off for all drives.

Let me know if you see anything "off" that I may have missed. My next step will be to follow the instructions from the support forum...

Thanks!

 

"Shadow Copies of volume C: aborted" (Event ID 36)...

Thanks for the replies and information.

Yes, I do have Paragon ExtFS for Windows installed. It allows read / write to the ext4 file system from within Windows. I don't use it all of the time, but it installs a ParagonMounter service, which is set to automatic startup by default. The program won't work if ParagonMounter service is set to manual.

I guess that could then be the cause for the origin of the aborted shadow copies?, as well as my abnormal System Protection settings.

If that's the case, I'm not too worried about it. I don't feel a need for the shadow copies. My original intent was to address the Event ID 36 by either removing the "user imposed limit" it referenced, or disabling the shadow copies.

At this point, is there anything more I should do? I guess I could just safely ignore any Event ID 36 errors in the Windows System Event Viewer logs.

 

"Shadow Copies of volume C: aborted" (Event ID 36)...

I noticed a new Error in the Windows System Event Viewer logs, one I haven't seen before. Event ID 36, Source Volsnap: "The shadow copies of volume C: were aborted because the shadow copy storage could not grow due to a user imposed limit."

I don't recall ever setting such a limit... I don't really need shadow copies. I've never made use of them, as I backup my computer to image files on an external hard drive.

That said, I'd like to be able to address the error one way or another.

What should I do? Details of event are below.

Thanks for any info!

- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
<Provider Name="Volsnap" Guid="{cb017cd2-1f37-4e65-82bc-3e91f6a37559}" EventSourceName="volsnap" />

<EventID Qualifiers="49158">36</EventID>

<Version>0</Version>

<Level>2</Level>

<Task>0</Task>

<Opcode>0</Opcode>

<Keywords>0x80000000000000</Keywords>

<TimeCreated SystemTime="2017-02-21T03:54:13.439234600Z" />

<EventRecordID>68672</EventRecordID>

<Correlation />

<Execution ProcessID="4" ThreadID="5268" />

<Channel>System</Channel>

<Computer>DESKTOP-NDLCEAK</Computer>

<Security />

</System>


- <EventData>
<Data Name="DeviceName">\Device\HarddiskVolumeShadowCopy2</Data>

<Data Name="VolumeName">C:</Data>

<Data Name="NTSTATUS">00000000</Data>

<Data Name="SourceTag">164</Data>

<Data Name="SourceFileID">0x0005</Data>

<Data Name="SourceLine">2586</Data>

<Binary>000000000600300000000000240006C0A40000000000000000000000000000000000000000000000</Binary>

</EventData>


</Event>