When AU is performing a System Restore Point before cleaning out registry errors, it causes Windows 10 Volume Shadow Copy Service to generate an error as shown in the Event Viewer. This is 100% repeatable and has been present for previous builds of Windows 10 x64.
Volume Shadow Copy Service error: Unexpected error querying for the IVssWriterCallback interface. hr = 0x80070005, Access is denied.
. This is often caused by incorrect security settings in either the writer or requestor process.
Operation:
Gathering Writer Data
Context:
Writer Class Id: {e8132975-6f93-4464-a53e-1050253ae220}
Writer Name: System Writer
Writer Instance ID: {91705321-7f6a-470e-a934-970d72f8b27f}
+ System
- Provider
[ Name] VSS
- EventID 8194
[ Qualifiers] 0
Level 2
Task 0
Keywords 0x80000000000000
- TimeCreated
[ SystemTime] 2016-02-23T07:17:20.891561400Z
EventRecordID 1712
Channel Application
Computer ASUSHomeBuilt
Security
- EventData
0x80070005, Access is denied.
Operation: Gathering Writer Data Context: Writer Class Id: {e8132975-6f93-4464-a53e-1050253ae220} Writer Name: System Writer Writer Instance ID: {91705321-7f6a-470e-a934-970d72f8b27f}
2D20436F64653A20575254575254494330303030313238392D2043616C6C3A20575254575254494330303030313234332D205049443A202030303030313739362D205449443A202030303030313839362D20434D443A2020433A5C57494E444F57535C53797374656D33325C737663686F73742E657865202D6B204E6574776F726B53657276696365202020202020202D20557365723A204E616D653A204E5420415554484F524954595C4E4554574F524B20534552564943452C205349443A532D312D352D3230
--------------------------------------------------------------------------------
Binary data:
In Words
0000: 6F43202D 203A6564 57545257 43495452
0010: 30303030 39383231 6143202D 203A6C6C
0020: 57545257 43495452 30303030 33343231
0030: 4950202D 20203A44 30303030 36393731
0040: 4954202D 20203A44 30303030 36393831
0050: 4D43202D 20203A44 575C3A43 4F444E49
0060: 535C5357 65747379 5C32336D 68637673
0070: 2E74736F 20657865 4E206B2D 6F777465
0080: 65536B72 63697672 20202065 20202020
0090: 7355202D 203A7265 656D614E 544E203A
00a0: 54554120 49524F48 4E5C5954 4F575445
00b0: 53204B52 49565245 202C4543 3A444953
00c0: 2D312D53 30322D35
In Bytes
0000: 2D 20 43 6F 64 65 3A 20 - Code:
0008: 57 52 54 57 52 54 49 43 WRTWRTIC
0010: 30 30 30 30 31 32 38 39 00001289
0018: 2D 20 43 61 6C 6C 3A 20 - Call:
0020: 57 52 54 57 52 54 49 43 WRTWRTIC
0028: 30 30 30 30 31 32 34 33 00001243
0030: 2D 20 50 49 44 3A 20 20 - PID:
0038: 30 30 30 30 31 37 39 36 00001796
0040: 2D 20 54 49 44 3A 20 20 - TID:
0048: 30 30 30 30 31 38 39 36 00001896
0050: 2D 20 43 4D 44 3A 20 20 - CMD:
0058: 43 3A 5C 57 49 4E 44 4F C:\WINDO
0060: 57 53 5C 53 79 73 74 65 WS\Syste
0068: 6D 33 32 5C 73 76 63 68 m32\svch
0070: 6F 73 74 2E 65 78 65 20 ost.exe
0078: 2D 6B 20 4E 65 74 77 6F -k Netwo
0080: 72 6B 53 65 72 76 69 63 rkServic
0088: 65 20 20 20 20 20 20 20 e
0090: 2D 20 55 73 65 72 3A 20 - User:
0098: 4E 61 6D 65 3A 20 4E 54 Name: NT
00a0: 20 41 55 54 48 4F 52 49 AUTHORI
00a8: 54 59 5C 4E 45 54 57 4F TY\NETWO
00b0: 52 4B 20 53 45 52 56 49 RK SERVI
00b8: 43 45 2C 20 53 49 44 3A CE, SID:
00c0: 53 2D 31 2D 35 2D 32 30 S-1-5-20