Skip to content

vss

Jump to bottom
Jorgen Lundman edited this page Aug 6, 2026 · 3 revisions

Windows Volume Shadow Copy Service (VSS) / Previous Versions

OpenZFS on Windows includes a native VSS hardware provider that exposes ZFS snapshots as Windows shadow copies. This enables the Previous Versions tab in Windows Explorer, allowing files and folders to be browsed and restored from any ZFS snapshot.

Prerequisites

  • OpenZFS installed (the VSS provider is registered automatically by the installer)
  • A ZFS pool imported and mounted on a drive letter (e.g. E:)
  • Windows Server. The ShadowCopies support was removed from Windows 11 by Microsoft.

Verify the provider is registered

Open an elevated command prompt and run:

vssadmin list providers

You should see OpenZFS VSS Provider in the list:

Provider name: 'OpenZFS VSS Provider' Provider type: Software Provider Id: {89300202-3cae-4584-b38f-e72f2b3a2fbf} Version: 1.0

Creating snapshots

There are two ways to create snapshots that appear as Previous Versions.

Method 1 — ZFS snapshots directly

ZFS snapshots are automatically exposed to VSS as shadow copy devices:

zfs snapshot tank@before-changes

Make some changes to files on E:, then take another snapshot:

zfs snapshot tank@after-changes

Both snapshots will appear in the Previous Versions tab for any file or folder on E:.

Method 2 — diskshadow

Open an elevated command prompt, launch diskshadow, and create a persistent shadow copy:

DISKSHADOW> set context persistent nowriters DISKSHADOW> add volume E: DISKSHADOW> create

Example output:

Alias VSS_SHADOW_1 for shadow ID {03f46441-bbe4-4706-ab1a-8f0201e9cf88} set as environment variable. Alias VSS_SHADOW_SET for shadow set ID {ba014dbe-71a2-4e1b-92ca-65694935fa23} set as environment variable.

      * Shadow copy ID = {03f46441-bbe4-4706-ab1a-8f0201e9cf88}
              - Original volume name: \\?\Volume{...}\ [E:\]
              - Shadow copy device name: \\?\GLOBALROOT\Device\ZfsSnapshot6f2b1de901ac9208
              - Provider ID: {89300202-3cae-4584-b38f-e72f2b3a2fbf}
              - Attributes:  No_Auto_Release Persistent Client_accessible No_Writers Differential

Make changes to files on E:, then create a second shadow copy the same way. Windows requires at least two shadow copies (or one shadow copy plus a changed current state) for the Previous Versions tab to show meaningful restore points.

Viewing Previous Versions in Explorer

  1. Open Windows Explorer and navigate to E:\ (or any subfolder/file)
  2. Right-click → Properties
  3. Click the Previous Versions tab

Each ZFS snapshot or VSS shadow copy appears as a dated restore point. You can:

  • Open — browse the snapshot contents read-only
  • Copy — copy individual files or folders out of the snapshot
  • Restore — roll back the selected item to that point in time

Listing and deleting shadow copies

DISKSHADOW> list shadows all

To delete a specific shadow copy:

DISKSHADOW> delete shadows ID {Shadow-ID} for example "delete shadows ID {3e690e9a-08d4-4b67-ae60-d0519e5ceff4}"

Or to delete all shadow copies for the volume:

DISKSHADOW> DELETE SHADOWS VOLUME E:

Shadow copies created via zfs snapshot can also be deleted the normal ZFS way:

zfs destroy tank@before-changes

Notes

  • Shadow copy devices appear under \?\GLOBALROOT\Device\ZfsSnapshot — these are virtual read-only volumes backed directly by the ZFS snapshot.
  • The VSS provider runs as the ZfsVssProvider Windows service, started on demand by the VSS infrastructure.
  • persistent nowriters is recommended for diskshadow usage — this creates durable shadow copies that survive reboots, matching the lifetime of the underlying ZFS snapshot.

Clone this wiki locally