Managing Shadow Copies with WMIC - Creation, Restoration, and Deletion

Question

Managing Shadow Copies with WMIC - Creation, Restoration, and Deletion

Anonymous

We are currently using the command mentioned below to create a shadow copy using WMIC.

``

wmic shadowcopy call create volume=<DRIVE>:\

``

Our specific requirement is to restore only particular folders and files from the drive. To accomplish this, we have created a shortcut and employed Robocopy. Are there any optimized approaches for file or folder-specific restoration?

Furthermore, when it comes to deleting the shadow copy, is there a specific age limit or expiry option? If not, will we be able to identify who has created the copy? If not, as we would need the shadow copy ID to achieve this, is there a more secure way to store this information at the OS level without introducing any security threats?

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question. To protect privacy, user profiles for migrated questions are anonymized.

2 answers

Answer 1

Hi,

The win32_shadowcopy class has no method to restore folders or files so I think you can keep using robocopy.

Regarding deleting shadow copies, you can use "vssadmin delete shadows" and there is no age limit or expiry option. The shadow copies are created by the volume shadow copy service which logs on as Local System. To list details of shadow copies, you can use the command "vssadmin list shadows".

vssadmin | Microsoft Learn

Best Regards,

Ian Xue

Answer 2

vssadmin.exe allows to set maximum size to the shadowcopy area, by volume, and to manually (for instance via cmd or scheduled tasks) delete "oldest" copy by volume as well

https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/vssadmin

Share via

Managing Shadow Copies with WMIC - Creation, Restoration, and Deletion

2 answers