Since SP2 I get Event 4321 every 5 minutes in the Event log

V

Vic Russell

Hi,

On my office laptop I am now getting Event 4321 every 5 minutes. I have
disabled the firewall because we are behind an office ISA.

The event reads:-

Event Type: Error
Event Source: NetBT
Event Category: None
Event ID: 4321
Date: 23/08/2004
Time: 07:25:37
User: N/A
Computer: PI-104
Description:
The name "MICROSEC :1d" could not be registered on the Interface with
IP address 137.223.3.133. The machine with the IP address 137.223.3.99 did
not allow the name to be claimed by this machine.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

I have tried to research this but none of the solutions mentioned seem to
lead anywhere. Any ideas?

Regards,

Vic Russell
 
H

Haggis

Vic Russell said:
Hi,

On my office laptop I am now getting Event 4321 every 5 minutes. I have
disabled the firewall because we are behind an office ISA.

The event reads:-

Event Type: Error
Event Source: NetBT
Event Category: None
Event ID: 4321
Date: 23/08/2004
Time: 07:25:37
User: N/A
Computer: PI-104
Description:
The name "MICROSEC :1d" could not be registered on the Interface
with IP address 137.223.3.133. The machine with the IP address
137.223.3.99 did not allow the name to be claimed by this machine.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

I have tried to research this but none of the solutions mentioned seem to
lead anywhere. Any ideas?

Regards,

Vic Russell
Click to expand...

sounds like your DHCP server is not assigning your IP correctly

try at command prompt

ipconfig /release
then
ipconfig /renew
 
M

Microsoft

This problem is directly related to DNS. You will also probably see Event ID
1054 messages in the application logs. In this case, a recent application
install led to DNS being reconfigured, which resulted in the client losing
Domain communication.


www.helpline4it.com
The Best IT Community Portal!
www.helpline4it.com
 
B

Bob Qin [MSFT]

Hi Vic,

Thanks for your posting here.

This problem may be caused by a NetBIOS name conflict between the
workstation and either another workstation with the same NetBIOS name, or a
workgroup or domain with the same NetBIOS name as the workstation.

To resolve this problem, you can try one of the following:

- Change the NetBIOS name of the workstation.
- Delete the conflicting NetBIOS name in Windows Internet Naming Service
(WINS).

Have a nice day!

Regards,
Bob Qin
Microsoft Online Partner Support

Get Secure! - www.microsoft.com/security

====================================================
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
====================================================
This posting is provided "AS IS" with no warranties, and confers no rights.

--------------------
From: "Vic Russell" <[email protected]>
Subject: Since SP2 I get Event 4321 every 5 minutes in the Event log
Date: Mon, 23 Aug 2004 08:17:08 +0100
Newsgroups: microsoft.public.windowsxp.setup_deployment

Hi,

On my office laptop I am now getting Event 4321 every 5 minutes. I
have
disabled the firewall because we are behind an office ISA.

The event reads:-

Event Type: Error
Event Source: NetBT
Event Category: None
Event ID: 4321
Date: 23/08/2004
Time: 07:25:37
User: N/A
Computer: PI-104
Description:
The name "MICROSEC :1d" could not be registered on the
Interface with
IP address 137.223.3.133. The machine with the IP address
137.223.3.99 did
not allow the name to be claimed by this machine.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

I have tried to research this but none of the solutions mentioned
seem to
lead anywhere. Any ideas?

Regards,

Vic Russell
 
V

Vic Russell

Thanks for that Bob,

However, I'm still a little confused. I assume you mean WINS on the machine
137.223.3.99 which is the one that "did not allow the name to be claimed by
this machine" - see below. However, I can not find any reference to the
137.223.3.133 machine in WINS on that server.

Can you explain what I may be doing wrong or mis-understanding?

Kind regards,

Vic

==========================================================================================
Event Type: Error
Event Source: NetBT
Event Category: None
Event ID: 4321
Date: 24/08/2004
Time: 13:09:10
User: N/A
Computer: PI-104
Description:
The name "MICROSEC :1d" could not be registered on the Interface with
IP address 137.223.3.133. The machine with the IP address 137.223.3.99 did
not allow the name to be claimed by this machine.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 00 00 00 00 04 00 56 00 ......V.
0008: 00 00 00 00 e1 10 00 c0 ....á..À
0010: 01 01 00 00 01 00 00 c0 .......À
0018: 45 00 00 00 00 00 00 00 E.......
0020: 00 00 00 00 00 00 00 00 ........
==========================================================================================
 
B

Bob Qin [MSFT]

Hi Vic,

Yes, you are right. The Event: 4321 Source: netBT is a little-known netBT
message that results whenever the workstation is attempting to register its
netBIOS name either by broadcast or directly with WINS and it receives a
"name in use" response.

You can search the netbios name in the WINS server. There should be another
workstation or workgroup record in WINS with the same name as this
workstation was trying to register. The WINS server was refusing the
registration, so its IP address showed up in the netBT 4321 error as the
server preventing the registration.

To make the event go away delete the duplicate WINS record and choose a
different name for either the workgroup or the workstation.

Regards,
Bob Qin
Microsoft Online Partner Support

Get Secure! - www.microsoft.com/security

====================================================
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
====================================================
This posting is provided "AS IS" with no warranties, and confers no rights.

--------------------
From: "Vic Russell" <[email protected]>
Subject: Re: Since SP2 I get Event 4321 every 5 minutes in the Event
log
Date: Tue, 24 Aug 2004 13:15:27 +0100
Newsgroups: microsoft.public.windowsxp.setup_deployment

Thanks for that Bob,

However, I'm still a little confused. I assume you mean WINS on the
machine
137.223.3.99 which is the one that "did not allow the name to be
claimed by
this machine" - see below. However, I can not find any reference to
the
137.223.3.133 machine in WINS on that server.

Can you explain what I may be doing wrong or mis-understanding?

Kind regards,

Vic


============================================================================
==============
Event Type: Error
Event Source: NetBT
Event Category: None
Event ID: 4321
Date: 24/08/2004
Time: 13:09:10
User: N/A
Computer: PI-104
Description:
The name "MICROSEC :1d" could not be registered on the
Interface with
IP address 137.223.3.133. The machine with the IP address
137.223.3.99 did
not allow the name to be claimed by this machine.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 00 00 00 00 04 00 56 00 ......V.
0008: 00 00 00 00 e1 10 00 c0 ....á..À
0010: 01 01 00 00 01 00 00 c0 .......À
0018: 45 00 00 00 00 00 00 00 E.......
0020: 00 00 00 00 00 00 00 00 ........

============================================================================
==============
 
V

Vic Russell

Hi Bob,

I have searched through WINS on the server and can find no reference to my
machine or "MICROSEC :1d" as refered to in the error message. There
are references to MICROSEC (our domain name) however. Any idea what the
":1d" part is?

Kind regards,

Vic.
 
B

Bob Qin [MSFT]

Hi Vic,

You need to search MICROSEC in WINS. 1D is the record type in WINS. It
means <domain> record and is used for domain Master Browser.

Reference:

http://www.microsoft.com/windows2000/en/server/help/sag_WINS_add_NetbiosName
sReference.htm

Best regards,
Bob Qin
Microsoft Online Partner Support

Get Secure! - www.microsoft.com/security

====================================================
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
====================================================
This posting is provided "AS IS" with no warranties, and confers no rights.

--------------------
From: "Vic Russell" <[email protected]>
Subject: Re: Since SP2 I get Event 4321 every 5 minutes in the Event
log
Date: Wed, 25 Aug 2004 09:31:20 +0100
Newsgroups: microsoft.public.windowsxp.setup_deployment

Hi Bob,

I have searched through WINS on the server and can find no reference
to my
machine or "MICROSEC :1d" as refered to in the error message.
There
are references to MICROSEC (our domain name) however. Any idea what
the
":1d" part is?

Kind regards,

Vic.
 
V

Vic Russell

Hi Bob,

Here is the result of my search for MICROSEC in WINS on the server. Nothing
about 1Dh comes up.

KInd regards,

Vic

Record Name Type IP Address State Static Owner Version Expiration
MICROSEC [1Bh] Domain Master Browser 137.223.3.99 Active 137.223.3.99 1ACE
31/08/2004 09:09:44
MICROSEC [00h] Workgroup 137.223.3.99 Active 137.223.3.99 1F7 31/08/2004
09:09:44
MICROSEC [1Eh] Normal Group Name 137.223.3.99 Active 137.223.3.99 1
31/08/2004 09:09:44
MICROSEC-DMZ [00h] Workgroup 137.223.3.201 Tombstoned 137.223.3.99 1D59
03/01/2003 09:35:17
MICROSEC-DMZ [1Eh] Normal Group Name 137.223.3.201 Tombstoned 137.223.3.99
1D58 03/01/2003 09:35:16
 
V

Vic Russell

Hi Bob,

An update. I have now put the name of the WINS server into the setup for my
TCP/IP. The Error Events 4321 seemed to be replaced by Warning Events 3019
until I re-booted this morning. All seems to be OK as far as the log is
concerned but I am still confused! I didn't want to use WINS really and had
not set it up before. All was OK before SP2. Also as I said in my last
post, there seemed to be no reference to MICROSEC :1Dh on the server.

Can you throw any light on this?

Kind regards,

Vic
Vic Russell said:
Hi Bob,

Here is the result of my search for MICROSEC in WINS on the server.
Nothing about 1Dh comes up.

KInd regards,

Vic

Record Name Type IP Address State Static Owner Version Expiration
MICROSEC [1Bh] Domain Master Browser 137.223.3.99 Active 137.223.3.99
1ACE 31/08/2004 09:09:44
MICROSEC [00h] Workgroup 137.223.3.99 Active 137.223.3.99 1F7 31/08/2004
09:09:44
MICROSEC [1Eh] Normal Group Name 137.223.3.99 Active 137.223.3.99 1
31/08/2004 09:09:44
MICROSEC-DMZ [00h] Workgroup 137.223.3.201 Tombstoned 137.223.3.99 1D59
03/01/2003 09:35:17
MICROSEC-DMZ [1Eh] Normal Group Name 137.223.3.201 Tombstoned
137.223.3.99 1D58 03/01/2003 09:35:16



Bob Qin said:
Hi Vic,

You need to search MICROSEC in WINS. 1D is the record type in WINS. It
means <domain> record and is used for domain Master Browser.

Reference:

http://www.microsoft.com/windows2000/en/server/help/sag_WINS_add_NetbiosName
sReference.htm

Best regards,
Bob Qin
Microsoft Online Partner Support

Get Secure! - www.microsoft.com/security

====================================================
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
====================================================
This posting is provided "AS IS" with no warranties, and confers no
rights.

--------------------
From: "Vic Russell" <[email protected]>
Subject: Re: Since SP2 I get Event 4321 every 5 minutes in the Event
log
Date: Wed, 25 Aug 2004 09:31:20 +0100
Newsgroups: microsoft.public.windowsxp.setup_deployment

Hi Bob,

I have searched through WINS on the server and can find no reference
to my
machine or "MICROSEC :1d" as refered to in the error message.
There
are references to MICROSEC (our domain name) however. Any idea what
the
":1d" part is?

Kind regards,

Vic.
Click to expand...
Click to expand...
 
B

Bob Qin [MSFT]

Hi Vic,

I recommend that you change the NetBIOS name of the workstation since your
domain name is MICROSEC too.

As for the <1D> name, it is for the segment master browser, and should not
appear in WINS server.

You can find the following information about <1D> record on the web site I
provided before.

domain_name[1Dh]
Registered for use by master browsers, of which there is only one per
subnet. Backup browsers use this name to communicate with the master
browser, retrieving the list of available servers from the master browser.
WINS servers always return a positive registration response for
domain_name[1D], even though the WINS server does not register this name in
its database. Therefore, when a WINS server is queried for the
domain_name[1D], the WINS server returns a negative response, which forces
the client to broadcast for name resolution.

Have a nice day!

Regards,
Bob Qin
Microsoft Online Partner Support

Get Secure! - www.microsoft.com/security

====================================================
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
====================================================
This posting is provided "AS IS" with no warranties, and confers no rights.

--------------------
From: "Vic Russell" <[email protected]>
Subject: Re: Since SP2 I get Event 4321 every 5 minutes in the Event
log
Date: Thu, 26 Aug 2004 07:41:18 +0100
Newsgroups: microsoft.public.windowsxp.setup_deployment

Hi Bob,

An update. I have now put the name of the WINS server into the setup
for my
TCP/IP. The Error Events 4321 seemed to be replaced by Warning Events
3019
until I re-booted this morning. All seems to be OK as far as the log
is
concerned but I am still confused! I didn't want to use WINS really
and had
not set it up before. All was OK before SP2. Also as I said in my
last
post, there seemed to be no reference to MICROSEC :1Dh on the server.

Can you throw any light on this?

Kind regards,

Vic
Vic Russell said:
Hi Bob,

Here is the result of my search for MICROSEC in WINS on the server.
Nothing about 1Dh comes up.

KInd regards,

Vic

Record Name Type IP Address State Static Owner Version Expiration
MICROSEC [1Bh] Domain Master Browser 137.223.3.99 Active 137.223.3.99
1ACE 31/08/2004 09:09:44
MICROSEC [00h] Workgroup 137.223.3.99 Active 137.223.3.99 1F7 31/08/2004
09:09:44
MICROSEC [1Eh] Normal Group Name 137.223.3.99 Active 137.223.3.99 1
31/08/2004 09:09:44
MICROSEC-DMZ [00h] Workgroup 137.223.3.201 Tombstoned 137.223.3.99 1D59
03/01/2003 09:35:17
MICROSEC-DMZ [1Eh] Normal Group Name 137.223.3.201 Tombstoned
137.223.3.99 1D58 03/01/2003 09:35:16



Bob Qin said:
Hi Vic,

You need to search MICROSEC in WINS. 1D is the record type in WINS. It
means <domain> record and is used for domain Master Browser.

Reference:

http://www.microsoft.com/windows2000/en/server/help/sag_WINS_add_NetbiosName
sReference.htm

Best regards,
Bob Qin
Microsoft Online Partner Support

Get Secure! - www.microsoft.com/security

====================================================
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
====================================================
This posting is provided "AS IS" with no warranties, and confers no
rights.

--------------------
From: "Vic Russell" <[email protected]>
Subject: Re: Since SP2 I get Event 4321 every 5 minutes in the Event
log
Date: Wed, 25 Aug 2004 09:31:20 +0100
Newsgroups: microsoft.public.windowsxp.setup_deployment

Hi Bob,

I have searched through WINS on the server and can find no reference
to my
machine or "MICROSEC :1d" as refered to in the error message.
There
are references to MICROSEC (our domain name) however. Any idea what
the
":1d" part is?

Kind regards,

Vic.
Hi Vic,

Yes, you are right. The Event: 4321 Source: netBT is a little-known
netBT
message that results whenever the workstation is attempting
Click to expand...
to
register
its
netBIOS name either by broadcast or directly with WINS and
Click to expand...
it
receives a
"name in use" response.

You can search the netbios name in the WINS server. There
Click to expand...
should
be
another
workstation or workgroup record in WINS with the same name as this
workstation was trying to register. The WINS server was
Click to expand...
refusing
the
registration, so its IP address showed up in the netBT 4321
Click to expand...
error
as the
server preventing the registration.

To make the event go away delete the duplicate WINS record
Click to expand...
and
choose a
different name for either the workgroup or the workstation.

Regards,
Bob Qin
Microsoft Online Partner Support

Get Secure! - www.microsoft.com/security

====================================================
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
====================================================
This posting is provided "AS IS" with no warranties, and
Click to expand...
confers
no
rights.
Click to expand...
minutes in
the
Event
log
Date: Tue, 24 Aug 2004 13:15:27 +0100
Newsgroups: microsoft.public.windowsxp.setup_deployment

Thanks for that Bob,

However, I'm still a little confused. I assume you
Click to expand...
mean WINS
on the
machine
137.223.3.99 which is the one that "did not allow the
Click to expand...
name to
be
claimed by
this machine" - see below. However, I can not find any reference to
the
137.223.3.133 machine in WINS on that server.

Can you explain what I may be doing wrong or mis-understanding?

Kind regards,

Vic
Click to expand...
============================================================================
==============
Event Type: Error
Event Source: NetBT
Event Category: None
Event ID: 4321
Date: 24/08/2004
Time: 13:09:10
User: N/A
Computer: PI-104
Description:
The name "MICROSEC :1d" could not be registered on the
Interface with
IP address 137.223.3.133. The machine with the IP address
137.223.3.99 did
not allow the name to be claimed by this machine.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 00 00 00 00 04 00 56 00 ......V.
0008: 00 00 00 00 e1 10 00 c0 ....á..À
0010: 01 01 00 00 01 00 00 c0 .......À
0018: 45 00 00 00 00 00 00 00 E.......
0020: 00 00 00 00 00 00 00 00 ........
Click to expand...
============================================================================
==============
"Bob Qin [MSFT]" <[email protected]> wrote
Click to expand...
in
message
Hi Vic,

Thanks for your posting here.

This problem may be caused by a NetBIOS name conflict between the
workstation and either another workstation with the
Click to expand...
same
NetBIOS
name, or
a
workgroup or domain with the same NetBIOS name as the workstation.

To resolve this problem, you can try one of the following:

- Change the NetBIOS name of the workstation.
- Delete the conflicting NetBIOS name in Windows
Click to expand...
Internet
Naming
Service
(WINS).

Have a nice day!

Regards,
Bob Qin
Microsoft Online Partner Support

Get Secure! - www.microsoft.com/security

====================================================
When responding to posts, please "Reply to Group" via your
newsreader so
that others may learn and benefit from your issue.
====================================================
This posting is provided "AS IS" with no warranties,
Click to expand...
and
confers no
rights.
Click to expand...
minutes in
the
Event log
Date: Mon, 23 Aug 2004 08:17:08 +0100
Newsgroups: microsoft.public.windowsxp.setup_deployment

Hi,

On my office laptop I am now getting Event 4321
Click to expand...
every
5
minutes. I
have
disabled the firewall because we are behind an
Click to expand...
office
ISA.
The event reads:-

Event Type: Error
Event Source: NetBT
Event Category: None
Event ID: 4321
Date: 23/08/2004
Time: 07:25:37
User: N/A
Computer: PI-104
Description:
The name "MICROSEC :1d" could not be
Click to expand...
registered
on the
Interface with
IP address 137.223.3.133. The machine with the
Click to expand...
IP
address
137.223.3.99 did
not allow the name to be claimed by this machine.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

I have tried to research this but none of the solutions
mentioned
seem to
lead anywhere. Any ideas?

Regards,

Vic Russell
Click to expand...
Click to expand...
Click to expand...
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Similar Threads

Event ID 4321 - NetBT 5
Event ID 4321 1
Internet Browse Issue 2
NetBT Event ID 4321 and SNMP request? 2
Event ID 4321 2
Undocumented NetBT error 4321 0
Undocumented NetBT error 4321 2
error message 1

Top