FilterManager Event ID 3 During Backups

I have a 2-week-old installation of Server 2012 Essentials. Windows Server Backup runs twice per day. Every time the backup runs, I get about five of these errors in the System event log:

Log Name:      System
Source:        Microsoft-Windows-FilterManager
Event ID:      3
Level:         Error
User:          SYSTEM
Description: Filter Manager failed to attach to volume ‘\Device\HarddiskVolume27’.  This volume will be unavailable for filtering until a reboot.  The final status was 0xC03A001C.

Obviously "HarddiskVolume27" is not a permanent hard drive–it must be a VSS drive created for the backup. (The volume numbers are different in each event.) The errors do not stop after a reboot.

What does this error mean and how do I stop it?

Research

Microsoft partner support pointed me to this Japanese blog article. Google Translate does an okay job on the translation.

The blog tells us that the final status of 0xC03A001C means STATUS_VHD_INVALID_STATE, i.e. the VHD is in a disabled state.

The article also suggests how to identify the process that caused the error. In Event Viewer, click on the event’s Details tab. Click the plus sign (+) next to System and scroll down to see the ProcessID:

FilterManager Event 3

Open Task Manager to see your running proccess. In the Details tab, look for the Process ID (PID) identified above. In my case, it referred to SearchIndexer.exe, which is the Windows Search service.

I stopped the Windows Search service (and dependent services) and ran a backup. This time, I did not get any FilterManager errors.

Probable Cause

It seems that Windows Search is always watching for new hard drives to be attached to the system. As part of backing up, Windows Backup attaches new, temporary hard drives like "\Device\HarddiskVolume27", then detaches them. Windows Search can’t find the drive and says you have to reboot the system.

I could set up scheduled tasks to stop and start Windows Search before and after backups. But probably I will just ignore these errors. Hopefully these confusing events will be removed in a future hotfix or service pack.

23 thoughts on “FilterManager Event ID 3 During Backups

  1. tsw

    this is also the case for windows 8… after stopping “windows search” during backup, the error messages disappear.

  2. RD

    I’m seeing this error during backup but process Id = 4 which I think system process. That means a kernel system thread is having problem. Does this happens due to insufficient space on disk/volume or VSS storage.

  3. Mark Berry Post author

    If you have insufficient space, you should be seeing separate warnings from Windows Server Backup about that. But I don’t know why you would be seeing Process ID = 4. You might want to post that question on a Microsoft forum.

  4. David

    im having a simuler issue but process id is diffrent but you the mostlily answer ive seen regarding this error. can you offer any insight?

    Log Name: System
    Source: Microsoft-Windows-FilterManager
    Date: 5/10/2013 2:05:44 AM
    Event ID: 3
    Task Category: None
    Level: Error
    Keywords:
    User: SYSTEM
    Computer: Blanked for security
    Description:
    Filter Manager failed to attach to volume ‘DeviceHarddiskVolume55’. This volume will be unavailable for filtering until a reboot. The final status was 0xc03a001c.
    Event Xml:

    3
    0
    2
    0
    0
    0x8000000000000000

    109116

    System
    Blanked for security

    0xc03a001c
    24
    DeviceHarddiskVolume55

  5. Mark Berry Post author

    David, looks identical to me. What process ID does yours report? What process does that correspond to in Task Manager.?

  6. TJ

    Yup, I’m seeing the same thing on my Win 2012 server. PID = 4 Happens after the backup finishes.

  7. Noel Carboni

    On Win 8.1 (with Spring Update) I’m seeing these messages, and the Process ID indicates it’s the System process (ID 4). Windows Search is and has been Disabled for a long time.

    Interestingly, after the system ran for a few days the errors stopped being logged, but came back again after a reboot.

    See also this for more detailed information about what I’m seeing:
    http://social.technet.microsoft.com/Forums/en-US/cd4b6d2a-f1af-4806-9d95-073f8ddb6f71/number-of-system-log-errors-increasing-during-nightly-backup-what-can-be-done?forum=w8itprogeneral

    It seems that VSS-integrated backups are becoming less and less well integrated with the system in general. It’s a bad trend – and sloppy work on Microsoft’s part.

  8. Lynda

    I am getting the following message
    Filter Manager failed to attach to volume ‘\Device\Harddisk8\DR25’. This volume will be unavailable for filtering until a reboot. The final status was 0xC03A001C.
    and I only have a standalone PC on a Wireless Network. I don’t have a Server – but It seems that something has converted my computer into one.

  9. Mark Berry Post author

    Lynda, I’ve seen these messages on standalone computers too. I’m still ignoring the messages.

  10. Yasir

    Hello Mark, I am getting about the same message with Server2012R2 DC VM, it is all happening during Full back to an external hdd
    Filter Manager failed to attach to volume ‘\Device\HarddiskVolume426’. This volume will be unavailable for filtering until a reboot. The final status was 0xC03A001C
    But with different PID 1396
    Can you guys please share your thoughts on this as well
    Thanks

  11. Mark Berry Post author

    PIDs vary even on the same machine. If you want to know which task relates to that PID at any given time, you will need to use Task Manager to find the PID on your machine. I am still ignoring these FilterManager errors.

  12. Fred

    Hi Mark,

    Thanks for all the research.
    I’m having the same problem, but when I check the PID in the Task Manager I see the PI is vds.exe (Virtual Disk Service) not Windows Search. Windows Search is disabled.

    Currently running Windows 2016 and DPM 2016 on the server.

  13. Nicolas

    Hi everyone,

    event id 9, pid 4
    “Filter Manager failed to attach to file system control device object (CDO) ‘\Device\NamedPipe’. All volumes associated with this file system will be unavailable for filtering until a reboot. The final status was 0xC000000E” , is what i’m getting.
    Using Win10 x64 pro (ver.1709 build 16299.64) and i’m sure this didn’t occur on previous version , same machine .Searching but can’t find any info on how to resolve …Any ideas ??

    Tnx in advance

  14. Mark Berry Post author

    Fred, Nicolas, are you seeing adverse effects from these errors? I’m not sure they are worth worrying about especially if they occur on temporary/virtual disks that go away after the backup.

  15. Protopia

    I am also getting “Filter Manager failed to attach to file system control device object (CDO) ‘\Device\NamedPipe’. All volumes associated with this file system will be unavailable for filtering until a reboot. The final status was 0xC000000E.” on Windows 10 ver 1709, but not with this backup software.

    I have no idea of the cause or how to fix it.

  16. Protopia

    I suspect that this is a bug that has been introduced by a security change in Windows 10 ver 1709:

    According to https://msdn.microsoft.com/en-us/library/windows/desktop/aa365779(v=vs.85).aspx

    “Windows 10, version 1709: Pipes are only supported within an app-container; ie, from one UWP process to another UWP process that’s part of the same app. Also, named pipes must use the syntax “\\.\pipe\LOCAL\” for the pipe name.”

    This is supposed only to affect UWP to UWP communications, however I suspect that the second part about named pipes syntax is true across all named pipes and is breaking several pieces of software.

    Does anyone have MS support access and can check this with MS?

  17. Zilvermuis

    Filter Manager failed to attach to volume ‘\Device\Harddisk13\DR380’. This volume will be unavailable for filtering until a reboot. The final status was 0xC03A001C. Also have this with pid that belongs to vds.exe. Let me know if there is a fix. It happens only during back-ups.

  18. Serge Ayotte

    Like Zilvermius…
    My system Windows 2016, Backup Exec 16, getting the error and the PID points to VDS

  19. Protopia

    I did an upgrade from Win 10 1709 to Win 10 1709 (yes – upgraded to same version) and it fixed the error – so it appears to have been an install issue.

  20. Greg

    Well. it’s still here in Windows Server 2022. Obviously, M$ is not reading this blog.

Leave a Reply

Your email address will not be published. Required fields are marked *

Notify me of followup comments via e-mail. You can also subscribe without commenting.