EPDR/360 Microsoft Volume Shadow Copy hangs server 2025

Viduraje
Viduraje
in WatchGuard EPDR/EDR/EPP

There is an issue in Server 2025 standard with latest patches installed.

Settings > Per-computer Settings > Shadow Copies

'Enable Windows Shadow Copies to create a backup of computer files every day
' was enabled.

All 3 servers hang on the login screen, the credential prompt does not come up. Servers require a forced reboot.
Once the option is disabled from EPDR/360, the servers work fine.

The support advice was to disable shadow copies option, make sure defender is disabled.

The hangs do not leave any log entries. The initial point entries related to VSS were two error event IDs.
8193
13

I've noticed a warning certificate issue and a perforlib issue when they were about to hang, but can't confirm they were directly related.

There has been a similar issue in 2024, but the installation is about two months old, All new Server 2025 DCs, WatchGuard Agent reinstalled twice.
https://techsearch.watchguard.com/KB?SFDCID=kA1Vr0000001dqXKAQ

Has anyone had a similar issue? What steps did you take to fix the issue? TIA.

Comments

  • David_Carro
    David_Carro WatchGuard Representative

    hello @Viduraje

    Please open a case to support, as they have a solution to your case.

    Kind regards,

    David Carro | Technical support
    WatchGuard Technologies, Inc. | www.watchguard.com

  • williamcorlin
    williamcorlin

    Hi Viduraje,

    I haven't seen the exact same issue, but the fact that all three Server 2025 machines behave normally as soon as the EPDR/360 Shadow Copies option is disabled is a pretty strong indication that the interaction with VSS is involved.

    I would check the Windows VSS and VolSnap event logs immediately after a forced reboot, rather than relying only on the general System log. Event IDs 8193 and 13 would also make me look closely at the VSS writers/providers and whether any third-party provider is being loaded.

    Since these are DCs, I'd be reluctant to keep repeatedly testing the setting on production machines. If possible, I'd reproduce it on one server and collect the WatchGuard Agent/EPDR logs plus the VSS/VolSnap events while the setting is enabled. It would also be useful to compare the exact Agent/EPDR component versions on the three servers.

    Given that disabling the feature is currently the workaround, I'd leave it disabled while WatchGuard investigates rather than risk another forced reboot. The fact that the issue occurs consistently across three freshly installed Server 2025 systems is definitely worth adding to the support case.

    Hopefully WatchGuard can confirm whether there is a known compatibility issue with the current Server 2025 patches or the Shadow Copies component.

    https://techsearch.watchguard.com/KB?SFDCID=kA1Vr0000001dqXKAQheardle

Categories