Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 4311 Source: NetBT

Initialization failed because the driver device could not be created.
I had this problem on a Windows XP SP2 system that was fixed by following ME299357 from Microsoft.

Simply stated:
1. Run netsh int ip reset [ log_file_name]
2. Reboot.
Windows logs this event because a non-zero value is incorrectly returned when Windows detects and references the newly introduced network adaptor. The adaptor is redetected as part of the upgrade process. See ME900965 for details on this event.

This event can also occur if and when you uninstall RAS. See WITP72585 to solve the problem.
This error can occur because of an incorrect registry setting. In my case the value for HKLM\SYSTEM\CurrentControlSet\Services\NetBT\Parameters\TransportBindName was blank. I set it to "\Device\", rebooted and the error was gone.
I too had this situation caused from registering with Insightís cable modem. Uninstalling TCP/IP, rebooting, and then re-installing TCP/IP fixed the problem.
From a newsgroup post: "In my case the error started to appear after I ran the AT&T RedCon Configurator, which is the utility furnished by AT&T to reconfigure a user's PC from home to the new AT&T Broadband Internet. This error did not exist on my system prior to running this utility. It appears that the correct way to remove the NetBT error, which only seems to affect Win2K and WinXp, is to uninstall Internet Protocol (TCP/IP), reboot, and then re-install Internet Protocol (TCP/IP). This method worked for me on my Win2K SP2 system. If you have some apps that try to access the
Internet on boot-up, you will get a bunch of warning dialogs. Just ignore them because they will disappear once internet protocol is re-installed. To do this open Control Panel>Network and Dial-up Connections. Right click on Local Area Connection and select Properties. Highlight Internet Protocol (TCP/IP) and click on the Uninstall button. Reboot. Go to the same Local Area Connection Properties dialog and select the Install button. Highlight Protocol and click on the Add button. Select Internet Protocol (TCP/IP). Doing this will remove any bogus adapter bindings that RedCon Configurator leaves in the registry. A telephone call to Microsoft technical support suggested this approach. They suspect that the RedCon Configurator is attempting to uninstall, or reconfigure, remote access service (RAS) and not properly removing the adapter bindings to NetBT and TCP/IP. An eēmail response I received from AT&T technical support convinced me that they are clueless as to what RedCon Configurator is doing to my system".

This event may be logged incorrectly. See ME833747 for a hotfix applicable to Microsoft Windows XP.

See ME842715 and the link to "EventID 4311 from source Nbt" for additional information on this event.

I started having a problem with very slow system start/restart after installing some Windows updates for my XP system: August 2003, Cumulative Patch for Internet Explorer 6 Service Pack 1 (ME822925) and Security Update for Microsoft Data Access Components (ME823718). I noticed this error in the Event Viewer and did some poking around, and ended up clearing the checkbox for "Microsoft TCP/IP version 6" in the properties dialog for my NIC (Control Panel/Network Connections). After this the system restarted much faster and the event 4311 error stopped occurring. Iím not sure of all the ramifications of this, but I hope it may be of help to someone else.
You may also get this problem when you start directly an application, before everything in WinXP is loaded. I have 3 computers that act like this.
Dual machines were running (Wakeup using APM mode) on my network cards (realtek RTL8139/810X). What to do is disable one of these modes.
This event can occur in various circumstances:
- Some of the registry keys associated with RAS were not correctly removed when RAS was uninstalled. See the link to ME181548 for more details and resolution.
- These errors occur when you disable all WINS related bindings and Show Binding For is set to <All components>. They may also occur due to an incorrect order of the bindings. See the link to ME123981 for more details and resolution.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to



Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.