Event id: 4320

[1inNetworking]

I hv a windows 2000 server with 60 client pcs. I'm getting the following error.

Event ID: 4320
Source: NetBT
Description: Another machine has sent a name release message to this
machine probably because a duplicate name has been
detected on the TCP network. The IP address of the node
that sent the message is in the data. Use nbtstat -n in a
command window to see which name is in the Conflict state.

Address shown in hexadecimal code is changing.

I tried all the options given on microsoft site like deleting mib files, re-creating dhcp scope, deleting static mappings in wins and so on. Nothing seems to work. Also applied the reqd patches. Anybody can help me.

Thanks in advance

 

[1inNetworking]

Forgot to mention that my network is crawling because of this. So, I cannot ignore this error and continue. Pls help.

 

[jfwebber]

Take a look at this and see if it helps.

http://www.eventid.net/display.asp?eventid=4320&source=

Jim

Jim Webber
Network Administrator MCSE CNA

 

[1inNetworking]

thanks for the response. but as i said earlier the ip address shown in hexadecimal code is not same. It keeps changing. There is no duplicate name on the network.

 

[tsuji]

Hello 1inNetwork,

As mentioned in the msdn page:

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/w2kmsgs/4395.asp

You seem to have verified most of the thing, except maybe this:
<quote>
If a computer was configured for a name but the ipconfig -all command returned a different host name, go to the Registry editor and change the computer name in the TCP/IP parameters section.
</quote>
Have you verified the output from the cmdline of ipconfig -all?

regards - tsuji

 

[1inNetworking]

Hi tsuji,

I checked this from all the pcs(ip address shown in the error) from where this message. I checked in the server also for confirmation. Name shown with the command is same as how it was configured to be. This error started coming 2 weeks back and since then everyday I have to clear the event log file. Tircky problem. Any clues..........

Thnx

 

[tsuji]

Hello 1inNetworking,

Have you check out the older article Q120752. There is a procedure to locate the computer in conflict with nbtstat -a. Those as you said in your first posting, the ip is varying, have you at least attempt to locate it.

Also in that article, it said <quote> NOTE: This error message is generated in many cases due to normal circumstances, and should not be cause for alarm.</quote> What can you say with MS saying something like this. But, it certainly won't impress people having to clear the log.

regards - tsuji

 

[1inNetworking]

Hi tsuji

If you check my previous message I said in all pcs(IP addresses shown in the error) i.e, from where the server says it got a release message. I checked the ipconfig -all command and nbtstat command from those machines only apart from server. I read that q120752 on the first day and ignored the error as microsoft said. But after 3 days it seemed to slow down my network logon. And this error comes every minute. I dont see any other error for the slow network. Could not figure out what else could be the reason. Thank you for response.