Possible Causes of the NetBT Event ID 4320

ID: Q131740

The information in this article applies to:

Microsoft Windows NT Workstation versions 3.5, 3.51, 4.0
Microsoft Windows NT Server versions 3.5, 3.51, 4.0
Microsoft Windows 2000 Professional
Microsoft Windows 2000 Server
Microsoft Windows 2000 Advanced Server

IMPORTANT: This article contains information about editing the registry. Before you edit the registry, make sure you understand how to restore it if a problem occurs. For information about how to do this, view the "Restoring the Registry" Help topic in Regedit.exe or the "Restoring a Registry Key" Help topic in Regedt32.exe.

SYMPTOMS

The following error message may appear in the Event Viewer tool:

Event ID 4320 Source NetBT

CAUSE

There are several possible reasons why this error message may be generated:

There is a computer on the network with the same name.

Identical user name logged on to multiple computers.

Inactive or duplicate names in the WINS database.

Corruption in the DHCP database.

Conflicting network adapters in a multihomed computer.

IPCONFIG /ALL returns incorrect host name.

RESOLUTION

Computer on the Network with the Same Name

For information on translating the IP address of the computer posting the duplicate name error from the Event information, please see the following article in the Microsoft Knowledge Base:

Q120752 How to Diagnose Event ID 4320

If the IP address is all zeros, have the customer look to see if there are any Windows for Workgroups computers on the network with the same name. Windows for Workgroups computers will sometimes return all zeros for their IP address with this error.

Identical User Name Logged on to Multiple Computers

The user names will register with a <03h> and that will be the name in conflict. Have the user log off of all computers and log back on to just one.

Inactive or Duplicate Names in the WINS Database

Check the database to verify there are no duplicate entries.

For additional information, please see the following article(s) in the Microsoft Knowledge Base:

Q164016 Event ID: 4320 Duplicate Name on Network

Corruption in the DHCP Database

For a possibly corrupted DHCP database, clear DHCP related entries in the registry, as well as delete any .mib files, and then reinstall DHCP. It may be possible, if you reinstalled without cleaning out old settings in the registry, that the problem entries are still there.

Conflicting Network Adapters in a Multihomed Computer

Other computers on the network may indicate that the multihomed computer's second card is in conflict with its first. Those computers will then send the name release message.

IPCONFIG /ALL Returns Incorrect Host Name

Edit the registry and change the computer name in the TCP/IP parameters section.

WARNING: Using Registry Editor incorrectly can cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that problems resulting from the incorrect use of Registry Editor can be solved. Use Registry Editor at your own risk.

For information about how to edit the registry, view the "Changing Keys and Values" Help topic in Registry Editor (Regedit.exe) or the "Add and Delete Information in the Registry" and "Edit Registry Data" Help topics in Regedt32.exe. Note that you should back up the registry before you edit it. If you are running Windows NT, you should also update your Emergency Repair Disk (ERD).

Start Registry Editor (Regedt32.exe) and go to the following subkey:


      HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
      \Parameters

Double-click the Hostname value and edit the string data.

If none of these steps solve the errors from being logged and the your network is acting normal, there is not a problem. Windows NT 3.5 will log this error at times when there is not a problem. Windows NT 3.51 will not have the same problem. Even though there is not a solution for 3.5, be assured that, if you have gone through all the steps above, you are not having a problem.

For additional information, please see the following article(s) in the Microsoft Knowledge Base:

Q131739 Windows NT 3.5: NetBT Event ID 4320

Q164016 Err Msg: Event ID: 4320 Duplicate Name on Network

Additional query words:

Keywords : nttcp NTSrvWkst
Version : WINDOWS:2000; winnt:3.5,3.51,4.0
Platform : WINDOWS winnt
Issue type : kbprb