Overview

Shadow Copies, also known as Volume Shadow Copies or Volume Snapshot Service (VSS) copies, are a feature in Windows operating systems that allow for the creation of backups or snapshots of computer files or volumes, even while they are in use. These snapshots capture the state of the files at a particular point in time, enabling users to restore previous versions of files or recover from system errors.

There are some AV, or other protection software that creates a volume checkpoint periodically to protect the data. By default, these apps use the existing shadow copy setting, which means if you have already set the limitation to the maximum size, the app will use that setting. If you were not already configured, the app will use unbounded size which is unlimited.

Certain antivirus (AV) and other protection software has a feature to take a volume checkpoint periodically to protect the data. This to ensure, the data will be recoverable in case a Ransomware attack. These applications typically utilize the current shadow copy setting. So If a shadow copy size limitation has been previously set, the software will follow that limitation. But, if no configuration has not been set, the application set with an unbounded size, fectively providing unlimited size. This could cause the disk space issue on the server.

Adjust maximum shadow copies limitation.

Check the current limitaion

vssadmin list shadowstorage

Change Max Shadows to use 10%

  • This will adjust the volume C:\ to use maximum 10% of the total size.
vssadmin resize ShadowStorage /For=C: /On=C: /MaxSize=10%
  • This will adjust the volume D:\ to use maximum 10% of the total size. If you need to adjust the other volumes, you just need to change the volume drive letter.
vssadmin resize ShadowStorage /For=D /On=D: /MaxSize=10%
  • This will adjust the volume D:\ which store the VSS copies on the C:\ drive, to use maximum 10% of the total size.
vssadmin resize ShadowStorage /For=D /On=C: /MaxSize=10%

Managing shadow copies

This to delete the oldest checkpoints.

vssadmin delete shadows /for=c: /oldest