Norton Ghost EBAB03F1: The specified network name is no longer available

Question

Norton Ghost EBAB03F1: The specified network name is no longer available

After about 15 minutes, a Norton Ghost 14 backup fails with Error EBAB03F1: The specified network name is no longer available.

The source computer is a P4 laptop running Windows XP SP3. The target computer is a Core2 Quad desktop running Windows Vista Ultimate 64bit.

It does not help to disable Norton 360 on the source computer or Norton Antivirus 2008 on the target computer.

The Event Viewer consistently shows the same two VSS-related errors after Norton Ghost starts but before it fails. It makes no difference if the VSS service is started or stopped. The VSS errors do not appear elsewhere in the event log, only after Ghost starts.

The MSS event messages, however, are quite common, appearing throughout the log, and they may have nothing to do with the problem.

Here is the Norton Ghost error display...

-Errors exist.
--Unable to write to file.
---Error EBAB03F1: The specified network name is no longer available.
---Unable to set file size.
----Error EBAB03F1: The specified network name is no longer available.
----Unable to write to file.
-----Error EBAB03F1: The specified network name is no longer available.
-----Unable to set file size.
------Error EBAB03F1: The specified network name is no longer available.

Here are the source computer events, with the final error 
at the top and the "Ghost Starting" message at the bottom:
=====
Event Type: Error
Event Source:   Norton Ghost
Event Category: High Priority 
Event ID:   100
Date:       11/09/2009
Time:       9:40:26 AM
User:       N/A
Computer:   PAVILION2
Description:
Error EC8F17B7: Cannot create recovery points for job: 
Drive Backup of  (C:\) (3). 
Error E7D1001F: Unable to write to file. 
Error EBAB03F1: The specified network name is no longer available. 
Error E7D10046: Unable to set file size. 
Error EBAB03F1: The specified network name is no longer available. 
Error E7D1001F: Unable to write to file. 
Error EBAB03F1: The specified network name is no longer available. 
Error E7D10046: Unable to set file size. 
Error EBAB03F1: The specified network name is no longer available.
Details: 0xEBAB0005
Source: Norton Ghost

=====
Event Type: Information
Event Source:   MSSQL$SQLEXPRESS
Event Category: Server 
Event ID:   3421
Date:       11/09/2009
Time:       9:34:06 AM
User:       NT AUTHORITY\NETWORK SERVICE
Computer:   PAVILION2
Description:
Recovery completed for database ReportServer$SQLEXPRESSTempDB 
(database ID 6) in 1 second(s) (analysis 205 ms, redo 0 ms, 
undo 376 ms.) This is an informational message only. No user 
action is required.

For more information, see Help and Support Center at 
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 5d 0d 00 00 0a 00 00 00   ].......
0008: 15 00 00 00 50 00 41 00   ....P.A.
0010: 56 00 49 00 4c 00 49 00   V.I.L.I.
0018: 4f 00 4e 00 32 00 5c 00   O.N.2.\.
0020: 53 00 51 00 4c 00 45 00   S.Q.L.E.
0028: 58 00 50 00 52 00 45 00   X.P.R.E.
0030: 53 00 53 00 00 00 18 00   S.S.....
0038: 00 00 52 00 65 00 70 00   ..R.e.p.
0040: 6f 00 72 00 74 00 53 00   o.r.t.S.
0048: 65 00 72 00 76 00 65 00   e.r.v.e.
0050: 72 00 24 00 53 00 51 00   r.$.S.Q.
0058: 4c 00 45 00 58 00 50 00   L.E.X.P.
0060: 52 00 45 00 53 00 53 00   R.E.S.S.
0068: 00 00                     ..      

=====
Event Type: Information
Event Source:   MSSQL$SQLEXPRESS
Event Category: Server 
Event ID:   17137
Date:       11/09/2009
Time:       9:34:02 AM
User:       NT AUTHORITY\NETWORK SERVICE
Computer:   PAVILION2
Description:
Starting up database 'ReportServer$SQLEXPRESSTempDB'.

For more information, see Help and Support Center at 
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: f1 42 00 00 0a 00 00 00   ñB......
0008: 15 00 00 00 50 00 41 00   ....P.A.
0010: 56 00 49 00 4c 00 49 00   V.I.L.I.
0018: 4f 00 4e 00 32 00 5c 00   O.N.2.\.
0020: 53 00 51 00 4c 00 45 00   S.Q.L.E.
0028: 58 00 50 00 52 00 45 00   X.P.R.E.
0030: 53 00 53 00 00 00 18 00   S.S.....
0038: 00 00 52 00 65 00 70 00   ..R.e.p.
0040: 6f 00 72 00 74 00 53 00   o.r.t.S.
0048: 65 00 72 00 76 00 65 00   e.r.v.e.
0050: 72 00 24 00 53 00 51 00   r.$.S.Q.
0058: 4c 00 45 00 58 00 50 00   L.E.X.P.
0060: 52 00 45 00 53 00 53 00   R.E.S.S.
0068: 00 00                     ..      

=====
Event Type: Error
Event Source:   VSS
Event Category: None
Event ID:   5013
Date:       11/09/2009
Time:       9:28:32 AM
User:       N/A
Computer:   PAVILION2
Description:
Volume Shadow Copy Service error: Shadow Copy writer 
ContentIndexingService called routine RegQueryValueExW 
which failed with status 0x80070002 (converted to 
0x800423f4).

For more information, see Help and Support Center at 
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 57 53 48 43 4f 4d 4e 43   WSHCOMNC
0008: 32 32 39 32 00 00 00 00   2292....
0010: 57 53 48 43 49 43 00 00   WSHCIC..
0018: 32 38 37 00 00 00 00 00   287.....

=====
Event Type: Error
Event Source:   VSS
Event Category: None
Event ID:   5013
Date:       11/09/2009
Time:       9:28:32 AM
User:       N/A
Computer:   PAVILION2
Description:
Volume Shadow Copy Service error: Shadow Copy writer 
ContentIndexingService called routine 
RegQueryValueExW which failed with status 
0x80070002 (converted to 0x800423f4).

For more information, see Help and Support Center 
at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 57 53 48 43 4f 4d 4e 43   WSHCOMNC
0008: 32 32 39 32 00 00 00 00   2292....
0010: 57 53 48 43 49 43 00 00   WSHCIC..
0018: 32 38 37 00 00 00 00 00   287.....

=====
Event Type: Error
Event Source:   VSS
Event Category: None
Event ID:   12302
Date:       11/09/2009
Time:       9:28:32 AM
User:       N/A
Computer:   PAVILION2
Description:
Volume Shadow Copy Service error: An internal 
inconsistency was detected in trying to contact 
shadow copy service writers.  Please check to see 
that the Event Service and Volume Shadow Copy 
Service are operating properly.

For more information, see Help and Support Center 
at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 42 55 45 43 58 4d 4c 43   BUECXMLC
0008: 33 36 33 37 00 00 00 00   3637....
0010: 42 55 45 43 58 4d 4c 43   BUECXMLC
0018: 33 36 30 37 00 00 00 00   3607....

=====
Event Type: Information
Event Source:   Norton Ghost
Event Category: High Priority 
Event ID:   100
Date:       11/09/2009
Time:       9:27:57 AM
User:       N/A
Computer:   PAVILION2
Description:
Info 6C8F1F63: The drive-based backup job, 
Drive Backup of  (C:\) (3), has been started manually.
Details: 
Source: Norton Ghost

networking

windows-xp

windows-vista

ghost

asked on Server Fault Sep 11, 2009 by

Breck Carter

4 Answers

If you're running Ghost under Windows on what is quite a low spec machine the problem could well be one of the system unable to cope with all that's happening. This could result in internal process delays thay can cause network timeout issues, resulting in an apparent loss of connectivity. Ghost is rather intolerant of such things. Two things can be tried.

If possible lock the CPU speed to maximum
Try running Ghost under safe mode with networking, if that is even possible

If the latter works it is indicative of too much system load while Ghost is running under a normal boot up.

answered on Server Fault Sep 11, 2009 by

John Gardeniers

This isn't really an answer to the question, but it is a solution to the problem: Switch from using a network drive as the target for a Norton Ghost 14 backup, and use a locally attached USB 2 external drive... 100% reliable over several days, and more than twice as fast as a backup across a 100Mb TCP/IP LAN.

In other words, I've given up on fixing the EBAB03F1 symptom :)

Another note: A different computer, using Norton Ghost version 9, has never had any problems backing up across the same 100Mb TCP/IP LAN to the same drive on the same target computer. The EBAB03F1 problem was probably introduced by version 10... that's the version that was originally in use on the problem computer, and it was the reason to upgrade to version 14.

Anyway, there are advantages and disadvantates to USB drives. One advantage is price: dropping fast, to the point adding a USB external drive to every workstation for backup purposes is a viable alternative. Local printers, local backups, sometimes the simple brute force solution is the best solution.

answered on Server Fault Sep 21, 2009 by

Breck Carter

Just spotted this question and realize I'm a bit late to the party.

Anyways... a mapped drive network disconnection on a workstation OS after 15 minutes indicates that the server service believes the connection is idle, and is disconnecting it.

To fix this, enter this on the command line:

net config server /autodisconnect:-1

answered on Server Fault Apr 19, 2010 by

Chris Thorpe • edited Apr 19, 2010 by

Chris Thorpe

Are you running the Ghost session from within Windows? Or are you using the boot disk to create the image? There is also the possibility that the volume shadow copies on the source disk are corrupt and Ghost is choking on them. I usually have better luck creating images from a boot disk-maybe try that?

answered on Server Fault Sep 11, 2009 by

Josh Budde

User contributions licensed under CC BY-SA 3.0