How to Diagnose Event ID 4320 or 4319

This article was previously published under Q120752
This article has been archived. It is offered "as is" and will no longer be updated.
On your Windows NT-based computer, you may receive one of the following event log messages in Event Viewer:
Event ID: 4320
Source: NetBT
Type: Error
Description: Another machine has sent a name release message to thismachine probably because a duplicate name has beendetected on the TCP network. The IP address of the nodethat sent the message is in the data. Use nbtstat -n in acommand window to see which name is in the Conflict state.
Event ID: 4319
Source: NetBT
Type: Error
Description: A duplicate name has been detected on the TCP network.The IP address of the machine that sent the message is in the data.Use nbtstat -n in a command window to check which name is in the conflict state.
This message is caused when another computer sends a name release messageto your computer. The most likely reason for this is that a duplicate namehas been detected on the network.

Use the NBTSTAT -N command to see the name of the computer in the conflictstate. The IP address of the node that sent the message is in the datareturned by this command. The following example shows what the data maylook like in one of these events:

   0000:   00   00   04   00   01   00   54   00   0008:   00   00   00   00   e0   10   00   c0   0010:   00   00   00   00   00   00   00   00   0018:   00   00   00   00   00   00   00   00   0020:   00   00   00   00   00   00   00   00   0028:   e7   1a   65   16				

Offset 28 is the IP address of the computer requesting name release. Todetermine the decimal IP address, invert the four hexadecimal numbers andconvert them to decimal numbers separated by periods. Using this method,the IP address of E7 1A 65 16 becomes

The status column of the NBTSTAT output for the computer in conflict shouldcontain either "Conflict" or "Released."

You can run the NBTSTAT -A command with the IP address to get the computername.

NOTE: This error message is generated in many cases due to normalcircumstances, and should not be cause for alarm.
prodnt WINS Conflict

Article ID: 120752 - Last Review: 12/04/2015 10:31:00 - Revision: 2.1

Microsoft Windows NT Workstation 3.5, Microsoft Windows NT Workstation 3.51, Microsoft Windows NT Workstation 4.0 Developer Edition, Microsoft Windows NT Server 3.5, Microsoft Windows NT Server 3.51, Microsoft Windows NT Server 4.0 Standard Edition

  • kbnosurvey kbarchive kberrmsg kbhowto kbnetwork KB120752