Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am mystified by the following warning in the Event Viewer. It is very frequent and always the same. Can anyone explain this to me? Is it a cause for concern? Might it have anything to do with my backup application (Jungle Disk). You can find an evtx file here. Thanks very much.

Total number of events: 1

19433 / 02/08/11 15:00:01 / Application

Source : VSS

EventID : 12348

Category :

Volume Shadow Copy Service warning: VSS was denied access to the root of volume \?\Volume{95eb80be-c226-11df-92ef-002564879bfe}. Denying administrators from accessing volume roots can cause many unexpected failures, and will prevent VSS from functioning properly. Check security on the volume, and try the operation again.

Operation: Removing auto-release shadow copies Loading provider

Context: Execution Context: System Provider

share|improve this question
up vote 2 down vote accepted

See this

Event ID 12348


Ensure that VSS has access to the volume root directory

If the Volume Shadow Copy Service (VSS) does not have access to the volume root directory, shadow copy creation on the volume will fail.

To perform this procedure, you must have membership in Administrators, or you must have been delegated the appropriate authority.

To ensure that VSS has access to the volume root directory:

Open an elevated Command Prompt window. Click Start, click All Programs, click Accessories, right-click Command Prompt, and then click Run as administrator. Type icacls (VolumeRootPath) /grant system:f at the command prompt, where (VolumeRootPath) is the path to the volume root directory, for example, icacls C:\ /grant system:f

For more information about the icacls command, see




share|improve this answer
Thanks very much for your answer. In the following sentence in your reply, "Type icacls /grant system:f at the command prompt, where is the path to the volume root directory, for example, D:" there seems to be a word or words missing between the words "where" and "is"; the sentence just doesn't parse. Could you supply what's missing? Also, can you tell me how to determine what drive letter has been assigned (if any) to the volume with the GUID {95eb80be-c226-11df-92ef-002564879bfe}? I'm afraid what I have been able to find out on my own hasn't helped. Thanks again. – Animadversor Feb 26 '11 at 1:22
Normally it is Drive C: whatever the Operating system resides on. Click the "Source" link in my post for more information. I fixed my post also, sorry about that. – Moab Feb 26 '11 at 2:18
Thanks very much. The icacls command ran successfully. Now we'll see if I get anymore VSS errors. – Animadversor Feb 26 '11 at 5:57

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.