Share via

Overcoming EDR (CrowdStrike Falcon Sensor) Blocks when Deleting Volume Shadow Copies

Anonymous
2023-10-13T12:38:22+00:00

We utilize Volume Shadow Copy to create backups, and our standard method for deleting these shadow copies is through 'vssadmin delete shadows.' However, when we attempt to execute this command, the EDR (CrowdStrike Falcon Sensor) system blocks the process, preventing us from deleting the created shadow copy.

Are there alternative methods for deleting the shadow copy without being blocked by the EDR?

Windows for business | Windows Server | Storage high availability | Other

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question. To protect privacy, user profiles for migrated questions are anonymized.

0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Anonymous
    2023-10-16T03:02:29+00:00

    Hi rootcause000,

    You may give a try to the CIM. Run Get-CimInstance -ClassName Win32_ShadowCopy to get the shadow copies and see if you can remove them using Remove-CimInstance.

    windows - Accessing Volume Shadow Copy (VSS) Snapshots from powershell - Stack Overflow

    Best Regards,

    Ian Xue

    0 comments