CmdID

CmdID / Commands

vssadmin delete shadows

Deletes a specified volume's shadow copies. Windows commands reference

On Windows

Opens CmdID with your command. It is read in your browser and sent nowhere.

Windows

from the Windows commands reference, CC BY 4.0

Deletes a specified volume's shadow copies. You can only delete shadow copies with the client-accessible type. NOTE: If you encounter the error "Error: Snapshots were found, but they were outside of your allowed context," the shadow copies are not client-accessible and cannot be deleted with vssadmin. Use the diskshadow command instead to manage and delete those shadow copies.

vssadmin delete shadows /for=<ForVolumeSpec> [/oldest | /all | /shadow=<ShadowID>] [/quiet]

To delete the oldest shadow copy of volume C, type

vssadmin delete shadows /for=c: /oldestIdentify
/forSpecifies which volume's shadow copy will be deleted. Windows commands reference
/oldestDeletes only the oldest shadow copy. Windows commands reference

Trips 1 Sigma rule: highShadow Copies Deletion Using Operating Systems Utilities by Florian Roth (Nextron Systems), Michael Haag, Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community, Andreas Hunkeler (@Karneades)

To delete all client-accessible shadow copies of volume D, type

vssadmin delete shadows /for=d: /allIdentify
/forSpecifies which volume's shadow copy will be deleted. Windows commands reference
/allDeletes all of the specified volume's shadow copies. Windows commands reference

Trips 1 Sigma rule: highShadow Copies Deletion Using Operating Systems Utilities by Florian Roth (Nextron Systems), Michael Haag, Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community, Andreas Hunkeler (@Karneades)

To delete a single client-accessible shadow copy by its ID, first run vssadmin list shadows to find the shadow copy ID. Then run the following command, replacing c: with the volume that hosts the shadow copy and <ShadowID> with the ID you want to delete. Enter the ID in the format XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX, where each X is a hexadecimal character

vssadmin delete shadows /for=c: /shadow=<ShadowID>Identify
/forSpecifies which volume's shadow copy will be deleted. Windows commands reference
/shadowDeletes the shadow copy specified by ShadowID. Windows commands reference

Trips 1 Sigma rule: highShadow Copies Deletion Using Operating Systems Utilities by Florian Roth (Nextron Systems), Michael Haag, Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community, Andreas Hunkeler (@Karneades)

To delete all client-accessible shadow copies of volume D without showing progress messages, add the /quiet parameter

vssadmin delete shadows /for=d: /all /quietIdentify
/forSpecifies which volume's shadow copy will be deleted. Windows commands reference
/allDeletes all of the specified volume's shadow copies. Windows commands reference
/quietSpecifies that the command won't display messages while running. Windows commands reference

Trips 1 Sigma rule: highShadow Copies Deletion Using Operating Systems Utilities by Florian Roth (Nextron Systems), Michael Haag, Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community, Andreas Hunkeler (@Karneades)

Matches documented abuse: Tamper (T1490)

/for=<ForVolumeSpec>Specifies which volume's shadow copy will be deleted.
/oldestDeletes only the oldest shadow copy.
/allDeletes all of the specified volume's shadow copies.
/shadow=<ShadowID>Deletes the shadow copy specified by ShadowID. To get the shadow copy ID, use the vssadmin list shadows command. When you enter a shadow copy ID, use the following format, where each X represents a hexadecimal character: XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX
/quietSpecifies that the command won't display messages while running.