When Event id 8193 on windows server 2012 r2 occurs, it generally displays two different types of error messages.
Here at Ibmi Media, as part of our Server Management Services, we regularly help our Customers to fix Windows related errors.
In this context, we shall look into the main causes of this error and how to fix it.

Nature of VSS Error with Event ID 8193 on Windows server 2012 r2?

VSS EventID 8193  is generally related to the installation of the DHCP role on a Windows Server. This often happens when the Network Service account loses the permissions on the registry key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS\Diag.

Our Support Experts  have noticed that the installation of the VSS module – DHCP Jet Writer is often related to this error.

This module manages the creation of a correct shadow copy of the DHCP service. It changes permissions on the specified registry key during installation.
However, this error does not trigger any visible problems with services or apps.

Also, while we cross-check the list of VSS modules for the instance ID of VSS Writer with the command below, it also returns a message that there are no errors;

vssadmin list writers

How to fix VSS Error with Event ID 8193 on Windows server 2012 r2?

One of the methods that our Support Expert followed to fix this error is to manually grant the Full Control permission for Network Service on the specified key.
i. Run the Registry Editor (regedit.exe)
ii. Go to the registry key HKLM\SYSTEM\CurrentControlSet\services\VSS\Diag and open its permissions option.
iii. Find Network Service in the list and assign the Full Control permissions.

At times we go for restoring the default permissions on the registry instead of editing the registry manually. We use a special command CLI tool – SubInACL for this.
We use the command below:

cd “C:\Program Files (x86)\Windows Resource Kits\Tools”

subinacl.exe /Subkeyreg System\CurrentControlSet\Services\VSS\Diag /sddl=D:PAI(A;;KA;;;BA)(A;;KA;;;SY)(A;;CCDCLCSWRPSDRC;;;BO)(A;;CCDCLCSWRPSDRC;;;LS)(A;;CCDCLCSWRPSDRC;;;NS)(A;CIIO;RC;;;OW)(A;;KR;;;BU)(A;CIIO;GR;;;BU)(A;CIIO;GA;;;BA)(A;CIIO;GA;;;BO)(A;CIIO;GA;;;LS)(A;CIIO;GA;;;NS)(A;CIIO;GA;;;SY)(A;CI;CCDCLCSW;;;S-1-5-80-3273805168-4048181553-3172130058-210131473-390205191)(A;ID;KR;;;AC)(A;CIIOID;GR;;;AC)S:ARAI

In Windows Server 2008 R2, we use the command:

subinacl.exe /Subkeyreg System\CurrentControlSet\Services\VSS\Diag /sddl=O:SYG:SYD:PAI(A;;KA;;;BA)(A;;KA;;;SY)(A;;SDGRGW;;;BO)(A;;SDGRGW;;;LS)(A;;SDGRGW;;;NS)(A;CIIO;RC;;;S-1-3-4)(A;;KR;;;BU)(A;CIIO;GR;;;BU)(A;CIIO;GA;;;BA)(A;CIIO;GA;;;BO)(A;CIIO;GA;;;LS)(A;CIIO;GA;;;NS)(A;CIIO;GA;;;SY)(A;CI;CCDCLCSW;;;S-1-5-80-3273805168-4048181553-3172130058-210131473-390205191)

Then, we replace the permissions on the child objects in the Registry Editor. For that, open the Diag reg key properties and click “Permissions” -> “Advanced” -> “Replace all child object permissions”.

Finally, we need to restart Windows for the changes to take effect.

Volume Shadow Copy Service error: The security ID structure is invalid.

Another common format of the VSS error with the same Event ID 8193 is:

This error does not allow us to create a system state backup. It also prevents taking backup of our Hyper-V VMs through the Windows Server Backup.

Backup operation commonly triggers the error: “0x80042308: The specified object was not found”.

The “security structure is invalid” error relates to the incorrect entry in the profile’s reg key HKLM\Software\Microsoft\Windows NT\CurrentVersion\ProfileList.
This issue occurs when the VSS service (Shadow Copy Optimization Writer component) cannot find a user profile with the SID ending in .bak
A possible method to fix the error is to delete the registry key shown in the description of the ConvertStringSidToSid event.
i. Open the regedit.exe.
ii. Go to the HKLM\Software\Microsoft\Windows NT\CurrentVersion\ProfileList.
iii. Find and delete the registry key with the .bak suffix.
iv. Restart the computer and try to run the backup task again.

Now, we will need to check that the VSS service is enabled

To check that the VSS service is enabled:
i. Click Start, point to Administrative Tools, and then click Services.
ii. In the results pane, double-click Volume Shadow Copy.
iii. Ensure that the Startup type is set to Manual.
iv. Click OK.

[Still having issues with windows errors? – We are available to help you today.]