vssadmin: Verified Commands, Error Codes, and Production

vssadmin is the Windows Volume Shadow Copy Service (VSS) administrative CLI (v1.1) used to create, list, and delete point-in-time volume snapshots for backup, system restore, and forensic data extraction.

vssadmin Create Shadow /for=C:
vssadmin List Shadows /for=C:
vssadmin Delete Shadows /for=C: /Quiet
vssadmin List Writers
vssadmin List Providers
vssadmin List ShadowStorage
vssadmin Resize ShadowStorage /on=C: /For=C: /MaxSize=10GB

vssadmin Syntax Reference

Tested on Windows Server 2019 with VSS 1.1.

All commands require an elevated command prompt (Run as Administrator). The core subcommands are shown above.

vssadmin Rapid Reference Cheat Sheet

Advanced Implementation & Parameters

Shadow Copy Access via Device Path

Once a shadow copy is created, you can access it via the symbolic link: \?GLOBALROOTDeviceHarddiskVolumeShadowCopy{ID}. This bypasses the file system’s open-file locks and enables extraction of locked system files such as NTDS.dit and registry hives. Example:

rem List shadows to get the correct shadow ID
vssadmin List Shadows

rem Mount visible path (alternatively use drive letter via `mklink`)
rem Copy NTDS.dit from shadow copy
copy \?GLOBALROOTDeviceHarddiskVolumeShadowCopy1WindowsNTDSNTDS.dit C:temp
copy \?GLOBALROOTDeviceHarddiskVolumeShadowCopy1WindowsSystem32configSYSTEM C:temp

Note: For files open exclusively (e.g., by Active Directory), the native copy command may fail with “access denied”. Use raw volume reads via Invoke-VolumeShadowCopy (PowerShell) to extract the data.

Shadow Copy Storage and Retention

The /MaxSize parameter in Resize ShadowStorage controls how much disk space can be used for shadow copies. The default is unlimited (up to 10% of the source volume on some editions). To restrict:

vssadmin Resize ShadowStorage /on=D: /for=C: /MaxSize=5GB

This sets a hard cap; once exceeded, oldest shadows are deleted. For automation, combine with schtasks to call Create Shadow at intervals.

Error Resolution & Troubleshooting

Production-Grade Implementation

Security Hardening & Least Privilege

• Restrict vssadmin.exe execution to authorized backup service accounts via AppLocker or Windows Defender Application Control. Do not grant interactive users ability to run vssadmin Create Shadow.
• Monitor Event ID 8222 (Shadow Copy Created) and 8224 (Shadow Copy Deleted) to detect unauthorized snapshot creation—a common precursor to credential theft (e.g., HiveNightmare, CVE-2021-36934).
• For domain controllers, enable backup: only access to the NTDS.dit file via VSS instead of granting interactive SeBackupPrivilege to all admins.
• After forensic extraction, immediately delete shadow copies: vssadmin Delete Shadows /for=C: /Quiet to reduce attack surface.

Automation & Integration

• Schedule vssadmin Create Shadow via schtasks with /Quiet for consistent point-in-time backups. Combine with robocopy to back up the shadow drive.
• Set storage limits to avoid disk exhaustion: vssadmin Resize ShadowStorage /on=C: /for=C: /MaxSize=10%.
• Use PowerShell Get: WmiObject Win32_ShadowCopy for programmatic control (create/delete/mount) instead of parsing vssadmin output.

Performance Considerations

Shadow copy creation on write-heavy volumes (e.g., SQL Server data) can cause brief I/O pauses. Schedule during low-activity windows. Use vssadmin List Providers to confirm the hardware provider (if available) for faster snapshots. Default system provider uses copy-on-write; avoid over-fragmentation by reserving dedicated storage area on a separate volume.

vssadmin delete shadows /shadow={GUID}
vssadmin delete shadows /all

vssadmin delete shadows /for=C: /all /quiet

vssadmin create shadow /for=C:

vssadmin delete shadows /for=D: /all /quiet