Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 4319 Source: NetBT

Source
Level
Description
A duplicate name has been detected on the TCP network. The IP address of the machine that sent the message is in the data. Use nbtstat -n in a command window to check which name is in the conflict state.
Comments
 
We had two computers with DNS addressed added manually to the Domain Controllers. This error began appearing after they were switched to DHCP. Simply deleting the manual entries in DNS fixed the problem.
In my case, the server had two NIC cards but only one record in DNS. It seems to have caused a client computer to see a computer name conflict on the network. Adding an A record for the second NIC cleared the problem.
If nbtstat –n shows the domain <00> Group mapping in conflict, make sure the WINS server points to itself both as primary and secondary. See ME150520 and ME150737 for more details.
This problem occurred on our network because we had a security group in Active Directory with the same name as a computer on the network. For example: A security group named "FINANCE" in Active Directory will cause this problem if you have a server named "FINANCE". Change the name of the security group and the error will go away.
We have a Cisco VPN client on a Windows 2000 machine and in the connection options the setting "Stateful Firewall" was set. This situation was causing some network calls not to work, like ping from another machine to this machine and also the Microsoft’s VPN client was not working. After unsetting this option, all network traffic works fine.


This was happening to us when a user had their wireless NIC enabled and grabbing an IP address while also connected to the same network with their Ethernet adapter. The same hostname is used on both connections.
This problem occurs because the client computer overwrites the interdomain trust account (ITA) properties when you join the computer to the domain. See ME898064 for a hotfix applicable to Microsoft Windows 2000.

This issue was found on a Windows 2000 domain with two subnets connected by a Cisco router that has the ip helper command enabled. See the link to "Cisco Support Document ID: 49860" for a solution to this problem.

See "JSI Tip 1698" for additional information about this event.
As per Microsoft: "Your computer cannot access the network because its name is already being used by another computer on the network. Transmission Control Protocol requires each computer on the network to have a unique name". See MSW2KDB for more details.

See ME131740, ME269239, and the link to "www.chicagotech.net - wineventid" for possible causes of the NetBT EventID 4320 and 4319.
I fixed this problem on a NT BDC (part of Win 2003 AD) by disabling netbios bindings from WINS client (in TCT/IP properties of the NIC). After reboot, no netbios name could be registered, so I enabled NetBios WINS client, rebooted, and the event was gone.
In my case after a $245 call to MS Support, I discovered that someone had enabled SMB on a Canon iR2200 with the same name as the server. Line 0028 in the Event Properties provided the IP of the conflicting device. In my case, line 0028 was cd 01 a8 c0, the offending IP in Hex. Entering each Hex pair in the Windows Calculator in Scientific mode and clicking the Dec dot converted the IP in reverse. cd=205  01=1  a0=168  c0=192.
As per ME292822: "This error occurs when:
1. Routing and Remote Access Service (RRAS) is configured to permit incoming connections.
2. Domain Name System (DNS) is installed and configured locally".

See also the Dell group thread for some wery helpful information.

In my example, my Windows 2000 Advanced Server at 192.168.0.10 was picking up 192.168.0.100 from the Remote Access system as soon as someone dialed in; this broke WINS (running on the same server), causing the conflict. Rebooting would temporarily fix it until someone dialed in. "nbtstat" showed "conflict" under the <20> and <00> unique fields.
I came across this issue after a new server install. I found that the NIC Team had not taken and each NIC had its own IP address, one IP address being correct the other not. Reinstalled NIC Teaming to resolve issue.
I have some Win2K Pro boxes connected to a CISCO Catalyst 5505 Switch. Each port at the switch has a setting named "STP Fast Start Mode" with options Enabled/Disabled. If I set this to Disabled then I get the "A duplicate name has been detected on the TCP network" error. I changed it to Enabled and the problem is gone.
May occur if you are trying to run a Win2k Domain Controller on a VMWare computer. Has something to do with multiple adapters broadcasting. Try turning off NetBIOS.


When a user logs onto a machine that has the same name as the user, this error ends up in the event log.
Self-explanatory. The name refers to the NetBIOS name. The nbtstat -n will only work as long the conflicting machine is up and running.
The Problem: The Error was occuring on a Windows 2000 Domain Controller that was also acting as a DNS Server for the domain. The Cause: Multiple network adapters were installed, with Client for Microsoft Networks and Microsoft File and Printer Sharing enabled for each. Each adapter was broadcasting the NetBIOS name of the machine across the network, causing a conflict.
The Fix: Disable Client for Microsoft Networks and Microsoft File and Printer Sharing for one of the adapters. This will prevent the duplicate broadcasting of the same network name over the network.
Multihomed Advanced Servers set up for unicast mode load balancing (NLB) gave us this problem. (The one adapter is used for NLB incoming traffic, the other for dedicated incoming and all outgoing traffic). NetBIOS over TCP/IP was on on both adapters and nbtstat -n showed that both adapters were indeed configured with the respective name.
File and printer sharing needed on both the dedicated and the load balancing adapter, but NetBIOS name not needed on load-balancing adapter. Switching off NetBIOS over TCP/IP on load-balancing adapter solved problem.
This problem can occur if the SubnetMask is not correct.
Use xxx from Device\NetBT_Tcpip_xxx in eventlog. Find HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NetBT\Parameters\Interfaces
\tcpip_xxx and delete it, restart and problem will gone.
The error occurred on Domain member 2000 server. Problem stopped resources being shared on network. Error was due to WINS already having a static entry for the server. Problem was resolved by deleting relevant entries from Wins. I did have NBTSTAT -RR to update Wins following a reboot.
This event can also occur when a user has logged into more than one machine on the network using the exact same login ID. Example: Administrator logged into multiple servers at once. I have also seen it happen when someone physically removes a NIC without properly uninstalling it from the OS and then installs a different NIC. Old registry entries from the first NIC remain and can cause conflict. For further info see ME315259.
We had this error and event 8005 (source:MrxSmb) on a W2K domain controller. I just restarted the computer Browser service. The errors stopped and network browsing started working again.


This error came up on our Windows 2000 Advanced servers after installing NLB. The resolution was the same as below as in our case we were using 2 NICs, one for NLB and the other for server communication i.e. remote control, web site update. MS networking has to be disabled on the non-NLB NIC to resolve the problem.
A PC named \\Workshop1 was running on the Win2k Domain. This PC was re-installed without being removed from the Domain/AD. When the PC was installed it was named \\Workshop. When I later added this PC to the Domain, I renamed it to \\Workhsop1 and at the same time specified the domain. When I clicked OK etc, and it did give me this warning event. I resolved it like this:
1.I removed the \\Workshop1 entry from AD
2.I removed \\Workshop from the domain
3.I renamed \\Workshop to \\Workhop1 - REBOOTED
4.(After Reboot) I added \\Workhsop1 to the domain and the problem was solved.
We added a server to a workgroup. There was a NT-Domain with the same name reachable through the network. Changing the workgroup name solved the problem.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net.

Read more...

 

Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.

Read more...