{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260908-020-separate-requester-writer-and-provider-roles-when-reviewing-vss-backups/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260908-020-separate-requester-writer-and-provider-roles-when-reviewing-vss-backups/", "slug": "dse-20260908-020-separate-requester-writer-and-provider-roles-when-reviewing-vss-backups", "url": "https://update.dsesecurity.com/updates/dse-20260908-020-separate-requester-writer-and-provider-roles-when-reviewing-vss-backups/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260908-020-separate-requester-writer-and-provider-roles-when-reviewing-vss-backups.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260908-020-separate-requester-writer-and-provider-roles-when-reviewing-vss-backups/" }, "title": "Separate requester, writer, and provider roles when reviewing VSS backups", "summary": "Identify the VSS components involved in a shadow-copy operation and collect evidence from each role during backup verification.", "format": { "slug": "explainer", "name": "Explainer" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "continuity-recovery", "label": "Continuity & recovery", "alt": "Paired infrastructure paths converging on a stable recovered service.", "card_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "business-continuity", "name": "Business Continuity", "url": "https://update.dsesecurity.com/topic/business-continuity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-08T18:16:51+00:00", "modified_at": "2026-09-08T18:17:13+00:00", "reviewed_on": "2026-09-08", "reading_minutes": 2, "word_count": 228, "potentially_affected": "Administrators reviewing Windows backups that use Volume Shadow Copy Service.", "dse_recommendation": "Map the actual backup requester, application writers, and shadow-copy provider before evaluating a VSS backup or failure.", "primary_source": { "name": "Volume Shadow Copy Service (VSS)", "url": "https://learn.microsoft.com/en-us/windows-server/storage/file-server/volume-shadow-copy-service", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Microsoft’s VSS reference separates three roles. A requester initiates shadow-copy operations and is commonly the backup application. A writer prepares a consistent application data set. A provider creates and maintains the shadow copy; that work can occur in software or storage hardware. VSS coordinates the components during shadow-copy creation.

\n

Applicability

\n

Identify the backup product, protected applications, and storage arrangement actually in use. Check the relevant product documentation before assuming that a particular application supplies a writer or that a storage array supplies the selected provider. Keep this component review distinct from decisions about backup retention and recovery objectives.

\n

DSE recommendation

\n

Create a short component map for each protected workload. Name the requester, required writers, selected provider, and administrator responsible for investigating each. During a failure review, preserve the original job details and timestamps before retrying. Ask which component reported the failure and which application data was included, rather than assigning every failure to the backup application by default.

\n

Verification

\n

Record component status around a controlled backup and preserve the corresponding application and backup logs. Restore a representative data set through the approved recovery procedure and have the application owner validate it. Keep successful snapshot creation and successful application restoration as separate results in the evidence record. Document missing components or unexplained errors as unresolved findings.

\n

Official references

\n

Microsoft Learn: Volume Shadow Copy Service. Source reviewed September 8, 2026.

", "content_text": "Source facts\nMicrosoft’s VSS reference separates three roles. A requester initiates shadow-copy operations and is commonly the backup application. A writer prepares a consistent application data set. A provider creates and maintains the shadow copy; that work can occur in software or storage hardware. VSS coordinates the components during shadow-copy creation.\nApplicability\nIdentify the backup product, protected applications, and storage arrangement actually in use. Check the relevant product documentation before assuming that a particular application supplies a writer or that a storage array supplies the selected provider. Keep this component review distinct from decisions about backup retention and recovery objectives.\nDSE recommendation\nCreate a short component map for each protected workload. Name the requester, required writers, selected provider, and administrator responsible for investigating each. During a failure review, preserve the original job details and timestamps before retrying. Ask which component reported the failure and which application data was included, rather than assigning every failure to the backup application by default.\nVerification\nRecord component status around a controlled backup and preserve the corresponding application and backup logs. Restore a representative data set through the approved recovery procedure and have the application owner validate it. Keep successful snapshot creation and successful application restoration as separate results in the evidence record. Document missing components or unexplained errors as unresolved findings.\nOfficial references\nMicrosoft Learn: Volume Shadow Copy Service. Source reviewed September 8, 2026.", "content_markdown": "## Source facts\n\n[Microsoft’s VSS reference](https://learn.microsoft.com/en-us/windows-server/storage/file-server/volume-shadow-copy-service) separates three roles. A requester initiates shadow-copy operations and is commonly the backup application. A writer prepares a consistent application data set. A provider creates and maintains the shadow copy; that work can occur in software or storage hardware. VSS coordinates the components during shadow-copy creation.\n\n## Applicability\n\nIdentify the backup product, protected applications, and storage arrangement actually in use. Check the relevant product documentation before assuming that a particular application supplies a writer or that a storage array supplies the selected provider. Keep this component review distinct from decisions about backup retention and recovery objectives.\n\n## DSE recommendation\n\nCreate a short component map for each protected workload. Name the requester, required writers, selected provider, and administrator responsible for investigating each. During a failure review, preserve the original job details and timestamps before retrying. Ask which component reported the failure and which application data was included, rather than assigning every failure to the backup application by default.\n\n## Verification\n\nRecord component status around a controlled backup and preserve the corresponding application and backup logs. Restore a representative data set through the approved recovery procedure and have the application owner validate it. Keep successful snapshot creation and successful application restoration as separate results in the evidence record. Document missing components or unexplained errors as unresolved findings.\n\n## Official references\n\n[Microsoft Learn: Volume Shadow Copy Service](https://learn.microsoft.com/en-us/windows-server/storage/file-server/volume-shadow-copy-service). Source reviewed September 8, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260908-020-separate-requester-writer-and-provider-roles-when-reviewing-vss-backups/", "url": "https://update.dsesecurity.com/updates/dse-20260908-020-separate-requester-writer-and-provider-roles-when-reviewing-vss-backups/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-08" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260908-020-separate-requester-writer-and-provider-roles-when-reviewing-vss-backups/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Separate requester, writer, and provider roles when reviewing VSS backups", "item": "https://update.dsesecurity.com/updates/dse-20260908-020-separate-requester-writer-and-provider-roles-when-reviewing-vss-backups/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260908-020-separate-requester-writer-and-provider-roles-when-reviewing-vss-backups/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260908-020-separate-requester-writer-and-provider-roles-when-reviewing-vss-backups/", "url": "https://update.dsesecurity.com/updates/dse-20260908-020-separate-requester-writer-and-provider-roles-when-reviewing-vss-backups/", "headline": "Separate requester, writer, and provider roles when reviewing VSS backups", "description": "Identify the VSS components involved in a shadow-copy operation and collect evidence from each role during backup verification.", "abstract": "Identify the VSS components involved in a shadow-copy operation and collect evidence from each role during backup verification.", "articleBody": "Source facts\nMicrosoft’s VSS reference separates three roles. A requester initiates shadow-copy operations and is commonly the backup application. A writer prepares a consistent application data set. A provider creates and maintains the shadow copy; that work can occur in software or storage hardware. VSS coordinates the components during shadow-copy creation.\nApplicability\nIdentify the backup product, protected applications, and storage arrangement actually in use. Check the relevant product documentation before assuming that a particular application supplies a writer or that a storage array supplies the selected provider. Keep this component review distinct from decisions about backup retention and recovery objectives.\nDSE recommendation\nCreate a short component map for each protected workload. Name the requester, required writers, selected provider, and administrator responsible for investigating each. During a failure review, preserve the original job details and timestamps before retrying. Ask which component reported the failure and which application data was included, rather than assigning every failure to the backup application by default.\nVerification\nRecord component status around a controlled backup and preserve the corresponding application and backup logs. Restore a representative data set through the approved recovery procedure and have the application owner validate it. Keep successful snapshot creation and successful application restoration as separate results in the evidence record. Document missing components or unexplained errors as unresolved findings.\nOfficial references\nMicrosoft Learn: Volume Shadow Copy Service. Source reviewed September 8, 2026.", "datePublished": "2026-09-08T18:16:51+00:00", "dateModified": "2026-09-08T18:17:13+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260908-020-separate-requester-writer-and-provider-roles-when-reviewing-vss-backups/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260908-020-separate-requester-writer-and-provider-roles-when-reviewing-vss-backups/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Separate requester, writer, and provider roles when reviewing VSS backups" }, "articleSection": [ "Business Continuity", "IT" ], "keywords": [ "Business Continuity", "IT", "Explainer", "Information priority" ], "genre": "Explainer", "about": [ { "@type": "Thing", "name": "Business Continuity", "url": "https://update.dsesecurity.com/topic/business-continuity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 228, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Volume Shadow Copy Service (VSS)", "url": "https://learn.microsoft.com/en-us/windows-server/storage/file-server/volume-shadow-copy-service" } } ] } }