NetBT Event ID 4320 Appears in Event Viewer

Support for Windows XP has ended

Microsoft ended support for Windows XP on April 8, 2014. This change has affected your software updates and security options. Learn what this means for you and how to stay protected.

This article was previously published under Q315259
This article has been archived. It is offered "as is" and will no longer be updated.
The following error message may appear in the Event Viewer tool:
Event ID: 4320
Source: NetBT
Description: Another machine has sent a name release message to this machine probably because a duplicate name has been detected on the TCP network. The IP address of the node that sent the message is in the data. Use nbtstat -n in a command window to see which name is in the Conflict state.
This article may also apply to Event ID: 4319.
This behavior can occur due to several possible reasons:
  • There is a computer on the network with the same name.
  • An identical user name is logged on to multiple computers.
  • There are inactive or duplicate names in the Windows Internet Naming Service (WINS) database.
  • There is corruption in the Dynamic Host Configuration Protocol (DHCP) database.
  • There are conflicting network adapters in a multihomed computer.
  • The ipconfig /all command returns an incorrect host name.
Important This section, method, or task contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, click the following article number to view the article in the Microsoft Knowledge Base:
322756 How to back up and restore the registry in Windows

Computer on the Network with the Same Name

Use the nbtstat -n command to see the name of the computer in the conflict state. The IP address of the node that sent the message is in the data that this command returns. The following example shows what the data may look like in one of these events:
   0000:   00   00   04   00   01   00   54   00   0008:   00   00   00   00   e0   10   00   c0   0010:   00   00   00   00   00   00   00   00   0018:   00   00   00   00   00   00   00   00   0020:   00   00   00   00   00   00   00   00   0028:   e7   1a   65   16				
Offset 28 is the IP address of the computer requesting name release. Todetermine the decimal IP address, invert the four hexadecimal numbers andconvert them to decimal numbers separated by periods. Using this method,the IP address of E7 1A 65 16 becomes

The status column of the nbtstat output for the computer in conflict should contain either "Conflict" or "Released."

You can run the nbtstat -a command with the IP address to get the computer name.

Identical User Name Logged on to Multiple Computers

The user names will register with a <03h>, and that will be thename in conflict. Ask the user to log off of all computers and logback on to just one computer.

Inactive or Duplicate Names in the WINS Database

Ask your system administrator to check the database to verify that there are no duplicate entries by deleting the static mapping in the WINS server. To do so, use the following steps:
  1. On the WINS server computer, start the WINS Manager.
  2. Click Mappings, click Static Mappings, and then click the entry that corresponds to your computer.
  3. Click Delete Mapping, and then click close.
  4. Restart your Windows XP-based computer (not the WINS server).

Corruption in the DHCP Database

For a possibly corrupted DHCP database, clear DHCP related entries inthe registry, delete any .mib files, and then reinstall DHCP. It may be possible, if you reinstalled without cleaning out old settings in the registry, that the entries that cause the behavior are still there.

Conflicting Network Adapters in a Multihomed Computer

Other computers on the network may indicate that the multihomed computer'ssecond card is in conflict with its first. Those computers then send the name release message.

"IPCONFIG /ALL" Returns Incorrect Host Name

Edit the registry, and change the computer name in the TCP/IP parameterssection:
  1. Start Registry Editor (Regedit.exe), and locate the HOSTNAME value in the following subkey:
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip \Parameters
  2. Double-click the HOSTNAME value, and then edit the string data.
Microsoft has confirmed that this is a problem in the Microsoft products that are listed at the beginning of this article.

Article ID: 315259 - Last Review: 12/07/2015 08:29:52 - Revision: 1.5

Microsoft Windows XP Home Edition, Microsoft Windows XP Professional, Microsoft Windows XP Professional x64 Edition

  • kbnosurvey kbarchive kbnetwork kbprb KB315259