ShadowProtect will not install when detecting Acronis is installed.

Article Number: 


This solution details the correct removal procedures of Acronis TrueImage and the file snapman.sys and snman380.sys


ShadowProtect cannot install because it detects that Acronis drivers like snapman.sys or snman380.sys exist in the C:\Windows\System32\Drivers directory

Deleting the snapman.sys or snman380.sys files without removing the registry entries can cause the system to crash with a blue screen (BSOD) or spontaneously reboots while ShadowProtect backups are running. This problem can occur when Acronis TrueImage drivers are still installed on the system. Acronis' snapshot driver (snapman.sys or snman380.sys) causes these crashes when ShadowProtect attempts to create a backup.


Currently, the only solution from StorageCraft is to uninstall Acronis TrueImage completely and reboot.

Below are the manual install steps.  As an additional note Acronis does have a link posted for a uninstall utility at the following link:

Sometimes the TrueImage uninstaller does not remove the driver files from the system. If crashes during backups persist after uninstalling TrueImage then follow these instructions to manually remove these drivers.  Note that as new versions of Acronis are released there may be additional drivers added to their software.  Please contact Acronis if you need further assistance with removing these drivers.

NOTE: Do not simply delete snapman.sys or snman380.sys, as this can cause your system to fail to boot or blue screen on boot. 

      1. Go to the Start | Run...  Type "regedit" and click OK.
      2. In the registry editor, navigate to:

        HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{4D36E967-E325 -11CE-BFC1-08002BE10318}.

      3. Remove the 'snapman' entry from the "UpperFilters" values. This will unregister the snapman.sys driver as a PnP filter for disk devices.
      4. Check the "LowerFilters" Key (if it exists) and remove any reference to Snapman
      5. Next, navigate to:

        HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{71A27CDD-812A -11D0-BEC7-08002BE2092F}.

      6. Remove the 'snapman' entry from the "UpperFilters" values. This will unregister the snapman.sys driver as a PnP filter for logical volume devices.
      7. Check the "LowerFilters" Key (if it exists) and remove any reference to Snapman
      8. Next, navigate to:


      9. Add a REG_DWORD value named DeleteFlag with a value 1 inside this 'snapman' key. To do this, go to the Edit | New | DWORD Value. Type the name 'DeleteFlag', then double-click the icon next to it to enter the value of 1. Click OK. Next, double-click the Start REG_DWORD value inside the snapman key to change its value to 4 (disabled).
      10. Reboot
      11. Navigate to C:\Windows\System32\Drivers and rename snapman.sys to snapman.old. if snapman.sys is not found also look for snman380.sys.
      12. Change the settings so that hidden and system files are shown as well if the files are not found with a search.
      13. Reboot (Important: This will insure that Snapman.sys have been removed successfully. If it has not, the machine will blue screen. You will need to reboot the computer into safe mode and ensure that the process is completed properly before you will be able to boot 'normal' again.)


If Snapman.sys or Snman380.sys are found on the computer and after the removal of the files and installation of ShadowProtect, the computer blue screens on boot, then snapman registry values were not removed properly.


This solution involves editing the Windows registry. It is strongly recommend that you make a backup of the Windows registry and the OS before making any changes to the registry. Incorrect use of the Windows registry editor may result in permanent data loss or corrupted files. Modify only the keys that are specified. Only persons who are experienced in the use of the registry editor application should modify the registry.)


ShadowProtect Version(s):
OS Bit Mode:



Issue these instructions

I found the key


HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{4D36E967-E325 -11CE-BFC1-08002BE10318}

multiple time in "class" -- does that mean I have to look at each one for the "snapman" entry?


Seagate Disc Wizard causes same issue

I received this same message about snapman.sys when trying to install ShadowProtect Desktop, but I had not ever installed an Acronis-branded product.

However, I had installed Seagate Disc Wizard v13.x solely to create a Disc Wizard boot CD that I used to duplicate a hard disk on a different PC. Disc Wizard is now powered by Acronis and apparently installed these unneeded components on my PC.

I uninstalled Seagate Disc Wizard and then ShadowProtect Desktop installed OK.


Acronis has posted a cleanup

Acronis has posted a cleanup utility that can automate the removal of these leftovers for the specified program versions found in the following article.


You can find the cleanup utility in this KB:


Nice clear article with

Nice clear article with detailed steps.  Resolved my issue when installing Shadowprotect.

Tom Skalsky

The uninstall link from

The uninstall link from STC-nephi worked great. glad to have the help. was able to install without a hitch after running it.


The Intel Data Migration

The Intel Data Migration Software, which I used to transfer the C: system disk contents from a hard drive to an Intel SSD,is powered by Intel and Snapman is left in the system as a result. Uninstalling the Intel Data Migration Software got rid of Snapman and solved the installation problem.

I just had this issue on

I just had this issue on three servers.  I found that Acronis has a True Image Cleanup utility.  Search for Acronis KB 48668.  There is a link to download the tool.

There is also a page to look at more then just True Image;

Acronis Cleanup Utility

Terms and Conditions of Use - Privacy Policy - Cookies