Manually Removing Zombie VSS Shadow Copies on a Windows Server

Overview

In some cases, Windows Volume Shadow Copy Service (VSS) snapshots (shadow copies) may remain on a server after a backup operation has completed. These leftover shadow copies, sometimes referred to as "zombie shadows", can consume storage space and may need to be removed manually.

This article explains how to identify and delete shadow copies using the DiskShadow utility.

---

Prerequisites

• Administrative access to the Windows server.
• Remote Desktop (RDP) access to the affected machine.
• Verify that the shadow copies are no longer required by any backup, recovery, or application process before deleting them.

---

Procedure

Step 1: Connect to the Server

1. RDP to the affected Windows machine.
2. Open PowerShell or Command Prompt as Administrator.

Step 2: Launch DiskShadow

Run the following command:

diskshadow

You should see the DiskShadow prompt:

DISKSHADOW>

Step 3: List Existing Shadow Copies

At the DiskShadow prompt, run:

list shadows all

This command displays all shadow copies currently present on the system.

Review the output and verify that the shadow copies are no longer needed.

---

Identifying CPM-Created Shadow Copies

If the shadow copy displays the following Provider ID: b5946137-7b9f-4925-af80-51abd60b20d5
the shadow copy was created by DiskShadow and was most likely generated by N2W/CPM during a backup operation.

Important note:

This Provider Id (b5946137-7b9f-4925-af80-51abd60b20d5) is the Diskshadow provider id and N2W use it to create vss shadows. Other vendors may have the same provider ID.

---

Delete All Shadow Copies

If you have confirmed that the shadow copies are no longer required, run the following command from the DiskShadow prompt:

delete shadows all

DiskShadow will remove all shadow copies present on the system.

Warning: This command deletes all VSS shadow copies on the server. Ensure there are no active backups, restore operations, or application dependencies before proceeding.

---

Verify Deletion

After the deletion completes, run:

list shadows all

 

No shadow copies should be returned, or only the currently active/required shadow copies should remain.

---

Additional Notes

• Only remove shadow copies after confirming they are no longer needed.
• Shadow copies created by N2W/CPM that remain after backups are typically safe to remove once the backup operation has completed successfully.
• If shadow copies continue to accumulate after backups, review the backup logs and VSS writer status to determine why cleanup is not occurring automatically.

---

Summary

To manually remove CPM-created zombie shadow copies:

diskshadow
list shadows all
delete shadows all
list shadows all

Verify that the shadow copies belong to the DiskShadow provider (b5946137-7b9f-4925-af80-51abd60b20d5) , and no other vendors are using this same provider ID, before deleting them.