Microsoft Volume Shadow Copy Service

1

Hi

I am trying to figure out a way to pull in the VSS information listed below from all of our computers at our company and pull the info below into BES as a property so we can easily report on this. Below you can see the output from my computer when running the following command in powershell “vssadmin list shadowstorage”. Has anyone setup relevance for something like this before?

Used Shadow Copy Storage space: 3.41 GB (2%)
Allocated Shadow Copy Storage space: 3.77 GB (3%)
Maximum Shadow Copy Storage space: 5.87 GB (5%)

2

I haven’t used this personally, but it looks like the data is stored in WMI so can be inspected using a relelvance based WMI query.

Q: selects "* from Win32_ShadowStorage" of wmis
A: AllocatedSpace=11328925696
A: DiffVolume=Win32_Volume.DeviceID="\\\\?\\Volume{1c7d741b-f346-4ca5-94d3-f5b048cee5a6}\\"
A: MaxSpace=25464615525
A: UsedSpace=10856263680
A: Volume=Win32_Volume.DeviceID="\\\\?\\Volume{1c7d741b-f346-4ca5-94d3-f5b048cee5a6}\\"
T: 10.916 ms
I: plural wmi select
1 Like
3

That is perfect. I am trying to separate those three properties and get them to each pull in separately into BES.

I want to pull in each of these properties separately.

-AllocatedSpace
-MaxSpace
-Used Space

I will create a property for each one of those separately and set as a column once I can get the data pulled in correctly. The three properties I will created eventually. VSS allocated space, VSS Max Space and VSS Used space.

Here is what I have so far to try and pull in the allocated space on its own from WMI. its erroring out though.

q: string whose (value of it != “AllocatedSpace”) of selects “from Win32_ShadowStorage” of wmis

I am still pretty new to this. Figuring this out as I get more familiar with the verbiage. If I can get what I have written above working I am figure out a way to pull the other two in.

4

As WMI inspections do create more workloads on the endpoint than many other inspections, you could also pull the data in 1 property. This results in a single inspection so less workloads on the endpoint side and less scope for data drift. Properties do potentially evaulate at different times so that create room for variation (eg AllocatedSpace could be several minutes different to when MaxSpace or UsedSpace where processes.

To do it all as 1 inspection

Q: concatenation ", " of (selects "AllocatedSpace, MaxSpace, UsedSpace from Win32_ShadowStorage" of wmis as string)
A: AllocatedSpace=12503330816, MaxSpace=25464615525, UsedSpace=12004102144
T: 12.449 ms
I: singular string

Obvioulsy it all depends what your own specific use case requires so this is just for info in case its of any help.

2 Likes
5

That is exactly what I was looking for. Thank you for your assistance.