Troubleshooting VSS Error 513 on Windows Server: Causes and Solutions

Updated: 11 Feb, 2025 • 0 • min read

Table of Contents

Troubleshooting Windows Server VSS Error 513

Encountering errors within Windows Server environments is a common challenge for system administrators. Among these, Volume Shadow Copy Service (VSS) errors can be particularly concerning due to their potential impact on data backup and system restore capabilities. Event ID 513, often logged in conjunction with VSS operations, is one such error that warrants careful attention. This article provides a detailed exploration of Event ID 513, specifically focusing on its causes and offering practical solutions to effectively resolve it, ensuring the smooth operation of your Windows Server and the integrity of your backup processes.

Understanding Volume Shadow Copy Service (VSS)¶

Before delving into the specifics of Event ID 513, it is crucial to understand the role and function of the Volume Shadow Copy Service (VSS) within Windows Server. VSS, also known as Volume Snapshot Service or shadow copy, is a Microsoft Windows service that allows for taking snapshots of computer volumes, either manually or automatically, even while applications are in use. These snapshots, referred to as shadow copies, enable consistent backups and point-in-time recovery, which are essential for data protection and disaster recovery strategies.

VSS operates through a coordinated interaction of three key components:

VSS Requester: This is typically the backup application that initiates the shadow copy process. It communicates with VSS to request the creation of a shadow copy set.
VSS Writer: These are applications, such as SQL Server, Exchange Server, or even the operating system itself, that have data to be backed up. Writers ensure data consistency before a shadow copy is taken, guaranteeing that the backup is application-consistent.
VSS Provider: This component is responsible for creating and managing the actual shadow copy. The default provider in Windows is the Microsoft Software Shadow Copy Provider.

When a backup application (requester) initiates a backup, VSS coordinates with the writers to prepare the data for snapshotting. Writers flush data to disk and freeze I/O operations momentarily to ensure data consistency. Once the data is prepared, the provider creates the shadow copy, which is a point-in-time snapshot of the volume. This snapshot can then be used by the backup application to perform the actual backup, without interrupting ongoing operations.

Symptoms of Event ID 513¶

Event ID 513 is typically logged in the Application event log and is associated with the Microsoft-Windows-CAPI2 source, which relates to Cryptographic Services. The error message accompanying Event ID 513 provides valuable clues to the underlying issue. A typical example of the Event ID 513 error message is as follows:

Log Name:      Application
Source:        Microsoft-Windows-CAPI2
Event ID:      513
Task Category: None
Level:         Error

Description:
An error occurred in Cryptographic Services while processing the OnIdentity() call in System Writer Object.

Details:
AddLegacyDriverFiles: Unable to back up image of binary Microsoft Link-Layer Discovery Protocol.

System Error:
Access is denied.

Let’s break down the key components of this error message:

Log Name: Application: This indicates that the error is logged in the Application event log, which is a standard repository for application-related events and errors.
Source: Microsoft-Windows-CAPI2: This specifies that the error originates from the Cryptographic Services infrastructure, pointing towards a potential issue within the system’s cryptographic components.
Event ID: 513: This is the unique identifier for this specific error event, allowing for easy identification and tracking.
Level: Error: This severity level clearly indicates that this is an error condition that needs to be addressed.
Description: An error occurred in Cryptographic Services while processing the OnIdentity() call in System Writer Object.: This part of the description highlights that the error occurred within Cryptographic Services during the processing of the OnIdentity() call within the System Writer. The System Writer is a VSS writer responsible for backing up system state components.
Details: AddLegacyDriverFiles: Unable to back up image of binary Microsoft Link-Layer Discovery Protocol.: This detail provides more specific information about the error. It indicates that the System Writer was unable to back up the image of the Microsoft Link-Layer Discovery Protocol (LLDP) binary, specifically Mslldp.sys.
System Error: Access is denied.: This crucial part of the error message reveals the root cause: an “Access is denied” error. This strongly suggests a permission-related issue.

The primary symptom of Event ID 513 is the logging of this error in the Application event log during VSS operations, particularly during backup processes. While the error itself might be logged, backups might still complete successfully. However, the presence of error events in the system logs is generally undesirable and should be investigated to ensure system stability and reliability. In some cases, recurring Event ID 513 errors could potentially indicate underlying permission issues that might escalate and impact critical system functions in the long run.

Root Cause Analysis: Permission Issues with System Writer and Mslldp.dll¶

The “Access is denied” system error within the Event ID 513 message points directly to a permission problem. Specifically, the error message indicates that the VSS System Writer, operating under the Cryptographic Services context, lacks the necessary permissions to access and read the Microsoft Link-Layer Discovery Protocol driver file, Mslldp.sys.

To understand this further, consider the following:

VSS System Writer: As mentioned earlier, the System Writer is a crucial VSS component responsible for backing up system state data, which includes drivers and other critical system files. It operates under the security context of the Cryptographic Services.
NT AUTHORITY\SERVICE Account: Cryptographic Services, like many other Windows services, runs under a specific service account. In this case, it runs as NT AUTHORITY\SERVICE. This account has a specific set of permissions and privileges within the operating system.
Microsoft Link-Layer Discovery Protocol (LLDP): LLDP is a vendor-neutral Layer 2 protocol used by network devices for advertising their identity, capabilities, and neighbors on a local area network. The driver file for LLDP is Mslldp.sys, and the associated DLL is Mslldp.dll.

The root cause of Event ID 513 is that the NT AUTHORITY\SERVICE account, under which the VSS System Writer operates, does not have the necessary permissions to read the Mslldp.sys file or access related components like Mslldp.dll. When the System Writer attempts to read information from the Microsoft Link-Layer Discovery Protocol driver during a VSS operation, the operating system denies access, resulting in the “Access is denied” error and the logging of Event ID 513.

This permission issue typically arises due to default security settings or potential modifications to system permissions that inadvertently restrict access for the NT AUTHORITY\SERVICE account to the LLDP driver files. While this error often does not prevent backups from completing, it indicates a potential security misconfiguration and generates unnecessary error logs, which can obscure other important events.

Step-by-Step Workaround: Granting Permissions to Mslldp.dll¶

The recommended workaround for resolving Event ID 513 is to explicitly grant the NT AUTHORITY\SERVICE account the necessary permissions to access the Microsoft Link-Layer Discovery Protocol driver DLL, Mslldp.dll. This can be achieved using the sc.exe command-line utility, which is used to manage Windows services.

Follow these steps to grant the required permissions:

Open an Administrative Command Prompt: It is essential to execute these commands from an elevated command prompt with administrator privileges. To do this, search for “Command Prompt” in the Start Menu, right-click on “Command Prompt,” and select “Run as administrator.”
Check Current Permissions: Before modifying permissions, it is good practice to check the existing permissions on the mslldp service. Execute the following command in the administrative command prompt:
```
sc sdshow mslldp
```
This command will display the security descriptor for the mslldp service. The output will be a Security Descriptor Definition Language (SDDL) string, which represents the current permissions. Copy this output string, as you will need it in the next step.
Grant Permissions to SERVICE Account: To grant the NT AUTHORITY\SERVICE account (represented as SU in SDDL) the necessary “read” permissions, you need to append the following access control entry (ACE) to the existing SDDL string:
```
(A;;CCLCSWLOCRRC;;;SU)
```
This ACE grants the following permissions to the SU (SERVICE) account:
- CCL: Control access
- CSW: Change state, start, stop, pause, continue, interrogate
- LOCR: Lock control, query lock status, reset lock status
- RRC: Read control
Now, combine the SDDL string you copied in step 2 with this ACE. The command to set the new security descriptor using sc sdset will look like this:
```
sc sdset mslldp <SDDL string from step 2>(A;;CCLCSWLOCRRC;;;SU)
```
Example: If the output of sc sdshow mslldp in step 2 was:
```
D:(D;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BG)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)(A;;CCDCLCSWRPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWRPWPDTLOCRRC;;;SO)(A;;LCRPWP;;;S-1-5-80-3141615172-2057878085-1754447212-2405740020-3916490453)
```
Then the command to execute in step 3 would be:
```
sc sdset mslldp D:(D;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BG)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)(A;;CCDCLCSWRPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWRPWPDTLOCRRC;;;SO)(A;;LCRPWP;;;S-1-5-80-3141615172-2057878085-1754447212-2405740020-3916490453)(A;;CCLCSWLOCRRC;;;SU)
```
Important: Ensure you correctly copy and paste the SDDL string from step 2 and append the ACE (A;;CCLCSWLOCRRC;;;SU) without any spaces or errors. Incorrectly modifying the SDDL string could potentially impact service functionality.
Verify Permissions (Optional): After running the sc sdset command, you can re-run the sc sdshow mslldp command to verify that the new ACE has been successfully added to the security descriptor. You should see (A;;CCLCSWLOCRRC;;;SU) appended to the output string.

After completing these steps, the NT AUTHORITY\SERVICE account will have the necessary permissions to access Mslldp.dll. This should resolve the “Access is denied” error and prevent Event ID 513 from being logged during subsequent VSS operations.

Best Practices and Preventative Measures¶

While the workaround described above effectively addresses Event ID 513, it is important to consider best practices and preventative measures to minimize the occurrence of similar permission-related issues in the future and maintain a secure and stable Windows Server environment.

Regularly Review Event Logs: Proactive monitoring of system and application event logs is crucial for identifying potential issues early. Regularly reviewing event logs can help detect errors like Event ID 513 and other anomalies before they escalate into more significant problems. Implement automated event log monitoring and alerting systems for timely notifications of critical errors.
Implement Least Privilege Principle: Adhere to the principle of least privilege when configuring permissions and access rights. Grant users and services only the minimum necessary permissions required to perform their designated tasks. Avoid over-permissive configurations, as they can increase security risks and potentially lead to permission conflicts.
Regular Security Audits: Conduct periodic security audits to review system configurations, user rights assignments, and service permissions. Identify and rectify any misconfigurations or deviations from security best practices. Security audits can help proactively identify and address potential vulnerabilities and permission-related issues.
Utilize Group Policy for Centralized Management: Leverage Group Policy to centrally manage security settings, user rights, and service permissions across your Windows Server environment. Group Policy provides a consistent and efficient way to enforce security policies and prevent configuration drift.
Keep Systems Updated: Regularly apply Windows updates and security patches to ensure your servers are protected against known vulnerabilities and security exploits. Updates often include fixes for permission-related issues and security enhancements.
Document Permission Changes: If you make any manual changes to service permissions or security descriptors, meticulously document these changes. Proper documentation is essential for troubleshooting, auditing, and maintaining a clear understanding of system configurations.

By implementing these best practices, you can significantly reduce the likelihood of encountering permission-related errors like Event ID 513 and improve the overall security and stability of your Windows Server environment.

Additional Troubleshooting Tips for VSS Issues¶

While the permission fix specifically addresses Event ID 513 related to Mslldp.dll, broader VSS issues might manifest through various error codes and symptoms. Here are some general troubleshooting tips for VSS related problems in Windows Server:

Check VSS Service Status: Ensure that the Volume Shadow Copy Service and related services (like the VSS Provider services) are running and configured correctly. Use the Services console (services.msc) to check the status of these services and restart them if necessary. Verify that their startup type is set to “Automatic” or “Manual” as appropriate.
Examine Disk Space and Shadow Copy Storage: Insufficient disk space on the volumes being shadow copied or inadequate storage allocated for shadow copies can lead to VSS failures. Verify that there is sufficient free space on the relevant volumes and check the shadow copy storage allocation using the vssadmin command-line tool (e.g., vssadmin list shadowstorage).
Review Other VSS Related Event Logs: In addition to the Application event log, check the System event log and the VSS specific event logs (if available) for other VSS related errors or warnings. These logs might provide further insights into the root cause of VSS issues.
Test VSS Functionality with vssadmin list writers: The vssadmin list writers command is a valuable tool for checking the status of all VSS writers on the system. Run this command in an administrative command prompt and examine the state of each writer. Any writer in a failed or error state can indicate a problem that needs to be investigated further.
Consider Antivirus and Backup Software Conflicts: In some cases, antivirus software or backup software itself can interfere with VSS operations. Temporarily disable antivirus or backup software (during troubleshooting, in a controlled environment) to rule out potential conflicts.
Check for Disk Errors: Underlying disk errors or file system corruption can also cause VSS failures. Run disk checking utilities (like chkdsk) to scan for and repair any disk errors.

By systematically investigating VSS issues using these troubleshooting steps and addressing any identified problems, you can ensure the reliable operation of your backup and recovery processes in Windows Server.

Conclusion¶

Event ID 513 in Windows Server, specifically related to VSS and Mslldp.dll, is typically caused by insufficient permissions for the NT AUTHORITY\SERVICE account to access the Microsoft Link-Layer Discovery Protocol driver. While this error might be benign in many cases, it is an indicator of a potential security misconfiguration and generates unnecessary error logs.

The recommended workaround, involving granting explicit read permissions to the NT AUTHORITY\SERVICE account for Mslldp.dll using the sc sdset command, effectively resolves this issue. Furthermore, adopting best practices for permission management, regular event log monitoring, and proactive security measures are crucial for preventing similar issues and maintaining a robust and secure Windows Server environment. By understanding the causes and solutions for Event ID 513 and implementing comprehensive VSS troubleshooting strategies, system administrators can ensure the reliable operation of backup and recovery systems, safeguarding critical data and system availability.

Do you have any experiences with VSS errors or Event ID 513? Share your troubleshooting tips and insights in the comments below!

Computacionvinchi