When performing a system state backup, the file created is only a couple of megabytes rather than the expected several hundred megabytes to several gigabytes. If you attempt to restore the file, it is not useable.
There are no errors in the EDR logs, and the job completes successfully.
What is wrong?
Check the Windows event viewer and verify that NTBACKUP and VSS are failing to create a shadow copy snapshot.
In short, we're unable to generate the system state snapshot because VSS can fail when called remotely. This is potentially due to one of several known 3rd party issues:
This is not an issue with Snap Server, Guardian OS OR EDR (since EDR simply calls upon the NTBACKUP API and it is the API that is failing).
Please refer to the above KB articles for fixes. Once VSS is working properly the system state backup should succeed.