VSS Writers with corresponding services

VSS Writers with corresponding services

Each VSS writer corresponds to a service. Instead of rebooting the whole server, when we need to register VSS Writers or get it out of Failed state,  we can only restart the relevant service. I haven’t seen a complete list so far so we will add them one by one :


VSS Writer

Service Name

Service Display Name

ASR Writer VSS Volume Shadow Copy
BITS Writer BITS Background Intelligent Transfer Service
COM+ REGDB Writer VSS Volume Shadow Copy
IIS Config Writer AppHostSvc Application Host Helper Service
IIS Metabase Writer IISADMIN IIS Admin Service
Microsoft Exchange Writer MSExchangeIS Microsoft Exchange Information Store
Microsoft Hyper-V VSS Writer vmms Hyper-V Virtual Machine Management
Registry Writer VSS Volume Shadow Copy
Shadow Copy Optimization Writer VSS Volume Shadow Copy
System Writer CryptSvc Cryptographic Services
WMI Writer Winmgmt Windows Management Instrumentation
WIDW Writer WIDWriter Windows Internal Database
HYPER-V VMMS Hyper-V Virtual Machine Management Service
Data Deduplication Writer DFSR Distributed File System Replication
SPSearch4 VSS Writer SPSearch4 Sharepoint Foundation Search V4

Failed Security Audits 4625 HMWorker Exchange 2013

Failed Security Audits 4625 HMWorker Exchange 2013

One of the first problems I encountered after Installing Exchange 2013 on Windows Server 2012 ( and R2 ) was that my security log grew to 200k events in just a few days. Event ID 4625 Unknown user name or bad password coming from your Healthmailox usually under the name of HealthMailbox4d14f344f…@domainname. The process producing it was “C:\Program Files\Microsoft\Exchange Server\V15\Bin\MSExchangeHMWorker.exe”. The problem itself is a bit masked. On the client side you can barely notice any problems but your Event Viewer is a different story. The problem indicates problems with your Health mailboxes even without upgrading or migrating. It happens with new installs too. So searching the web I found the solutions which at this point are very limited for such new technologies as Windows Server 2012 R2 and Exchange 2013.

I found the solution of re-creating your Health monitoring mailboxes to be working well for me. Here is how :

Open Exchange Management Shell as Administrator and type :

Get-Mailbox -monitoring | Get-MailboxStatistics


As you can see the ItemCount is large. We will be removing these mailboxes but we don’t have the full names displayed here. So we will run the same command put “| fl” it.

Get-Mailbox -monitoring | Get-MailboxStatistics | fl


Remove-Mailbox -Identity HealthMailbox4d14f344f6294c1fb8d3f45bf436452a and confirm Y.


Do this for the rest of the health monitoring mailboxes. Take their Identities from the “Get-Mailbox -monitoring | Get-MailboxStatistics | fl” command.

After your are done deleting them you will have to re-run the PrepareAD cmd from the Exchange setup.

Navigate your Exchange Shell to the bin directory of Exchange installation:

cd “Program Files\Microsoft\Exchange Server\V15\bin”

Once there type

setup.exe /preparead /iacceptexchangeserverlicenseterms

Wait for the setup to finish and restart the Exchange Health Manager service.

net stop msexchangehm

net start msexchangehm


This should re-create your health mailboxes. Run the Get-Mailbox -monitoring | Get-MailboxStatistics to double check.