Post sp1 Install error - Netbt Event ID 4321

I have installed Windows 2003 Server SP1 on two of our servers as a test.
After the install, I am receiving Event ID 4321 with a source of NetBT at
random intervals. These are occurring a few times an hour. The description
is:

The name "xxxx :1d" could not be registered on the Interface with ip
address 10.0.y.x. The machine with IP address 10.0.y.z did not allow the
name to be claimed by this machine.

Data: (with Words chosen instead of bytes)
0000: 00000000 00560004 00000000 c00010e1
0010: 00000101 c0000001 00000119 00000000
0020: 00000000 00000000

I cannot find anything on the Internet regarding this. Any help would be
greatly appreciated as I'd like to continue my sp1 rollout.

I am not sure why SP1 would cause this. It just means two IP addresses
resolve to the same name. Do you have two NICs in the same IP subnet? Or two
machines with the same name?

Kris Clymans wrote:
> I have installed Windows 2003 Server SP1 on two of our servers as a
> test. After the install, I am receiving Event ID 4321 with a source
> of NetBT at random intervals. These are occurring a few times an
> hour. The description is:
>
> The name "xxxx :1d" could not be registered on the Interface with
> ip address 10.0.y.x. The machine with IP address 10.0.y.z did not
> allow the name to be claimed by this machine.
>
> Data: (with Words chosen instead of bytes)
> 0000: 00000000 00560004 00000000 c00010e1
> 0010: 00000101 c0000001 00000119 00000000
> 0020: 00000000 00000000
>
> I cannot find anything on the Internet regarding this. Any help
> would be greatly appreciated as I'd like to continue my sp1 rollout.

Interestingly, the xxx name that is being mentioned in the event is not the
server name, but the domain name. That is what is throwing me off. It is
occurring on BOTH machines that I have upgraded to Windows 2003 SP1 and only
those machines. I have not updated my domain controllers yet. They are
running the fully patched, but not SP1 version of 2003 server.

"Bill Grant" wrote:

> I am not sure why SP1 would cause this. It just means two IP addresses
> resolve to the same name. Do you have two NICs in the same IP subnet? Or two
> machines with the same name?
>
> Kris Clymans wrote:
> > I have installed Windows 2003 Server SP1 on two of our servers as a
> > test. After the install, I am receiving Event ID 4321 with a source
> > of NetBT at random intervals. These are occurring a few times an
> > hour. The description is:
> >
> > The name "xxxx :1d" could not be registered on the Interface with
> > ip address 10.0.y.x. The machine with IP address 10.0.y.z did not
> > allow the name to be claimed by this machine.
> >
> > Data: (with Words chosen instead of bytes)
> > 0000: 00000000 00560004 00000000 c00010e1
> > 0010: 00000101 c0000001 00000119 00000000
> > 0020: 00000000 00000000
> >
> > I cannot find anything on the Internet regarding this. Any help
> > would be greatly appreciated as I'd like to continue my sp1 rollout.
>
>
>

Do you mean you have a server which has the same name as the domain's
Netbios name? That could well be the problem.


Kris Clymans wrote:
> Interestingly, the xxx name that is being mentioned in the event is
> not the server name, but the domain name. That is what is throwing
> me off. It is occurring on BOTH machines that I have upgraded to
> Windows 2003 SP1 and only those machines. I have not updated my
> domain controllers yet. They are running the fully patched, but not
> SP1 version of 2003 server.
>
> "Bill Grant" wrote:
>
>> I am not sure why SP1 would cause this. It just means two IP
>> addresses resolve to the same name. Do you have two NICs in the same
>> IP subnet? Or two machines with the same name?
>>
>> Kris Clymans wrote:
>>> I have installed Windows 2003 Server SP1 on two of our servers as a
>>> test. After the install, I am receiving Event ID 4321 with a source
>>> of NetBT at random intervals. These are occurring a few times an
>>> hour. The description is:
>>>
>>> The name "xxxx :1d" could not be registered on the Interface
>>> with ip address 10.0.y.x. The machine with IP address 10.0.y.z did
>>> not allow the name to be claimed by this machine.
>>>
>>> Data: (with Words chosen instead of bytes)
>>> 0000: 00000000 00560004 00000000 c00010e1
>>> 0010: 00000101 c0000001 00000119 00000000
>>> 0020: 00000000 00000000
>>>
>>> I cannot find anything on the Internet regarding this. Any help
>>> would be greatly appreciated as I'd like to continue my sp1 rollout.

We have same problem.

Updated ONE machine with SP1 to be sure we don't mess up the whole network.
I have searched all ways and I can not find anything that would help me
solve the problem.

We are running with Linux DNS/DHCP and a Windows Wins server.
If I disable NETBIOS over TCP , the error will disappear.
This is the ONLY way I can make the error to go away.
Any ideea what is wrong and WHAT did SP1 do to the netbios ?

Also if I manually set the WINS swerver IP address in the TCP/IP then the
error will go away but then I get another error:

The master browser has received a server announcement from the computer
SERVERX that believes that it is the master browser for the domain on
transport NetBT_Tcpip_{BB5833F1-37C6-419A-A. The master browser is stopping
or an election is being forced.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.


So any ideea on how to solve this problem without disabling NetBios or going
in and setting up Wins manually would be appreciated.
We have over 100 servers and in different locations .... would be a pain to
go and change on all and what would I do in the locations where there is no
Wins ??? Install one ?????????????


"Bill Grant" wrote:

> Do you mean you have a server which has the same name as the domain's
> Netbios name? That could well be the problem.
>
>
> Kris Clymans wrote:
> > Interestingly, the xxx name that is being mentioned in the event is
> > not the server name, but the domain name. That is what is throwing
> > me off. It is occurring on BOTH machines that I have upgraded to
> > Windows 2003 SP1 and only those machines. I have not updated my
> > domain controllers yet. They are running the fully patched, but not
> > SP1 version of 2003 server.
> >
> > "Bill Grant" wrote:
> >
> >> I am not sure why SP1 would cause this. It just means two IP
> >> addresses resolve to the same name. Do you have two NICs in the same
> >> IP subnet? Or two machines with the same name?
> >>
> >> Kris Clymans wrote:
> >>> I have installed Windows 2003 Server SP1 on two of our servers as a
> >>> test. After the install, I am receiving Event ID 4321 with a source
> >>> of NetBT at random intervals. These are occurring a few times an
> >>> hour. The description is:
> >>>
> >>> The name "xxxx :1d" could not be registered on the Interface
> >>> with ip address 10.0.y.x. The machine with IP address 10.0.y.z did
> >>> not allow the name to be claimed by this machine.
> >>>
> >>> Data: (with Words chosen instead of bytes)
> >>> 0000: 00000000 00560004 00000000 c00010e1
> >>> 0010: 00000101 c0000001 00000119 00000000
> >>> 0020: 00000000 00000000
> >>>
> >>> I cannot find anything on the Internet regarding this. Any help
> >>> would be greatly appreciated as I'd like to continue my sp1 rollout.
>
>
>

I haven't been able to find a resolution. I was thinking about applying sp1
to my DCs to see if that resolved the issue, but I have read a few horror
stories about doing that. With that said, I'm going to keep my eyes out for
anyone else having the issue and see how they resolve it or wait for a kb
article from MS.

"Gigi" wrote:

> We have same problem.
>
> Updated ONE machine with SP1 to be sure we don't mess up the whole network.
> I have searched all ways and I can not find anything that would help me
> solve the problem.
>
> We are running with Linux DNS/DHCP and a Windows Wins server.
> If I disable NETBIOS over TCP , the error will disappear.
> This is the ONLY way I can make the error to go away.
> Any ideea what is wrong and WHAT did SP1 do to the netbios ?
>
> Also if I manually set the WINS swerver IP address in the TCP/IP then the
> error will go away but then I get another error:
>
> The master browser has received a server announcement from the computer
> SERVERX that believes that it is the master browser for the domain on
> transport NetBT_Tcpip_{BB5833F1-37C6-419A-A. The master browser is stopping
> or an election is being forced.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
>
> So any ideea on how to solve this problem without disabling NetBios or going
> in and setting up Wins manually would be appreciated.
> We have over 100 servers and in different locations .... would be a pain to
> go and change on all and what would I do in the locations where there is no
> Wins ??? Install one ?????????????
>
>
> "Bill Grant" wrote:
>
> > Do you mean you have a server which has the same name as the domain's
> > Netbios name? That could well be the problem.
> >
> >
> > Kris Clymans wrote:
> > > Interestingly, the xxx name that is being mentioned in the event is
> > > not the server name, but the domain name. That is what is throwing
> > > me off. It is occurring on BOTH machines that I have upgraded to
> > > Windows 2003 SP1 and only those machines. I have not updated my
> > > domain controllers yet. They are running the fully patched, but not
> > > SP1 version of 2003 server.
> > >
> > > "Bill Grant" wrote:
> > >
> > >> I am not sure why SP1 would cause this. It just means two IP
> > >> addresses resolve to the same name. Do you have two NICs in the same
> > >> IP subnet? Or two machines with the same name?
> > >>
> > >> Kris Clymans wrote:
> > >>> I have installed Windows 2003 Server SP1 on two of our servers as a
> > >>> test. After the install, I am receiving Event ID 4321 with a source
> > >>> of NetBT at random intervals. These are occurring a few times an
> > >>> hour. The description is:
> > >>>
> > >>> The name "xxxx :1d" could not be registered on the Interface
> > >>> with ip address 10.0.y.x. The machine with IP address 10.0.y.z did
> > >>> not allow the name to be claimed by this machine.
> > >>>
> > >>> Data: (with Words chosen instead of bytes)
> > >>> 0000: 00000000 00560004 00000000 c00010e1
> > >>> 0010: 00000101 c0000001 00000119 00000000
> > >>> 0020: 00000000 00000000
> > >>>
> > >>> I cannot find anything on the Internet regarding this. Any help
> > >>> would be greatly appreciated as I'd like to continue my sp1 rollout.
> >
> >
> >

I waited a while before applying SP1 to a production server, but I have same
thing. I'm probably getting about 150 a day. They seem to come in pairs,
about 15-20 seconds apart. I am not using WINS on my network.

Event Type: Error
Event Source: NetBT
Event Category: None
Event ID: 4321
Date: 5/17/2005
Time: 12:58:07 PM
User: N/A
Computer: FS1
Description:
The name "DOMAIN :1d" could not be registered on the Interface with
IP address 10.50.152.206. The machine with the IP address 10.50.152.100 did
not allow the name to be claimed by this machine.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 00 00 00 00 04 00 56 00 ......V.
0008: 00 00 00 00 e1 10 00 c0 ....á..À
0010: 01 01 00 00 01 00 00 c0 .......À
0018: 05 02 00 00 00 00 00 00 ........
0020: 00 00 00 00 00 00 00 00 ........


"Kris Clymans" <(E-Mail Removed)> wrote in message
news:1A8726FE-436C-49CA-9D82-(E-Mail Removed)...
>I have installed Windows 2003 Server SP1 on two of our servers as a test.
> After the install, I am receiving Event ID 4321 with a source of NetBT at
> random intervals. These are occurring a few times an hour. The
> description
> is:
>
> The name "xxxx :1d" could not be registered on the Interface with ip
> address 10.0.y.x. The machine with IP address 10.0.y.z did not allow the
> name to be claimed by this machine.
>
> Data: (with Words chosen instead of bytes)
> 0000: 00000000 00560004 00000000 c00010e1
> 0010: 00000101 c0000001 00000119 00000000
> 0020: 00000000 00000000
>
> I cannot find anything on the Internet regarding this. Any help would be
> greatly appreciated as I'd like to continue my sp1 rollout.

I completely refromatted both servers and applied SP1 before I did any other
updates and the issue seems to go away. Not really an option for production
boxes at this point. I'm holding off on any further sp1 installs at this
time.

"Cary Fields" wrote:

> I waited a while before applying SP1 to a production server, but I have same
> thing. I'm probably getting about 150 a day. They seem to come in pairs,
> about 15-20 seconds apart. I am not using WINS on my network.
>
> Event Type: Error
> Event Source: NetBT
> Event Category: None
> Event ID: 4321
> Date: 5/17/2005
> Time: 12:58:07 PM
> User: N/A
> Computer: FS1
> Description:
> The name "DOMAIN :1d" could not be registered on the Interface with
> IP address 10.50.152.206. The machine with the IP address 10.50.152.100 did
> not allow the name to be claimed by this machine.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
> Data:
> 0000: 00 00 00 00 04 00 56 00 ......V.
> 0008: 00 00 00 00 e1 10 00 c0 ....á..À
> 0010: 01 01 00 00 01 00 00 c0 .......À
> 0018: 05 02 00 00 00 00 00 00 ........
> 0020: 00 00 00 00 00 00 00 00 ........
>
>
> "Kris Clymans" <(E-Mail Removed)> wrote in message
> news:1A8726FE-436C-49CA-9D82-(E-Mail Removed)...
> >I have installed Windows 2003 Server SP1 on two of our servers as a test.
> > After the install, I am receiving Event ID 4321 with a source of NetBT at
> > random intervals. These are occurring a few times an hour. The
> > description
> > is:
> >
> > The name "xxxx :1d" could not be registered on the Interface with ip
> > address 10.0.y.x. The machine with IP address 10.0.y.z did not allow the
> > name to be claimed by this machine.
> >
> > Data: (with Words chosen instead of bytes)
> > 0000: 00000000 00560004 00000000 c00010e1
> > 0010: 00000101 c0000001 00000119 00000000
> > 0020: 00000000 00000000
> >
> > I cannot find anything on the Internet regarding this. Any help would be
> > greatly appreciated as I'd like to continue my sp1 rollout.
>
>
>

I am also getting a Netbt Event ID 4321 error on a domain controller. I've
not applied Windows 2003 SP1 in my network yet.

The message says,
The name "PMO :1d" could not be registered on the Interface with
IP address 10.224.14.2. The machine with the IP address 10.224.1.2 did not
allow the name to be claimed by this machine.

PMO is the name of our domian and the 10.224.14.2 IP address is the address
of DC2 and the 10.224.1.2 IP address is the address of DC1.

I've not found any way to stop the message except to disable NetBIOS over
TCP/IP. However, I have not always received this message when NetBIOS
setting on the network card was set to default. So, something has happened
to cause it.

Any thoughts?

"Kris Clymans" wrote:

> I have installed Windows 2003 Server SP1 on two of our servers as a test.
> After the install, I am receiving Event ID 4321 with a source of NetBT at
> random intervals. These are occurring a few times an hour. The description
> is:
>
> The name "xxxx :1d" could not be registered on the Interface with ip
> address 10.0.y.x. The machine with IP address 10.0.y.z did not allow the
> name to be claimed by this machine.
>
> Data: (with Words chosen instead of bytes)
> 0000: 00000000 00560004 00000000 c00010e1
> 0010: 00000101 c0000001 00000119 00000000
> 0020: 00000000 00000000
>
> I cannot find anything on the Internet regarding this. Any help would be
> greatly appreciated as I'd like to continue my sp1 rollout.

<domainname 1d> is the name registered by the segment master
browser. Only one machine in each segment can register this name.

Drew wrote:
> I am also getting a Netbt Event ID 4321 error on a domain controller.
> I've not applied Windows 2003 SP1 in my network yet.
>
> The message says,
> The name "PMO :1d" could not be registered on the
> Interface with IP address 10.224.14.2. The machine with the IP
> address 10.224.1.2 did not allow the name to be claimed by this
> machine.
>
> PMO is the name of our domian and the 10.224.14.2 IP address is the
> address of DC2 and the 10.224.1.2 IP address is the address of DC1.
>
> I've not found any way to stop the message except to disable NetBIOS
> over TCP/IP. However, I have not always received this message when
> NetBIOS setting on the network card was set to default. So,
> something has happened to cause it.
>
> Any thoughts?
>
> "Kris Clymans" wrote:
>
>> I have installed Windows 2003 Server SP1 on two of our servers as a
>> test. After the install, I am receiving Event ID 4321 with a source
>> of NetBT at random intervals. These are occurring a few times an
>> hour. The description is:
>>
>> The name "xxxx :1d" could not be registered on the Interface
>> with ip address 10.0.y.x. The machine with IP address 10.0.y.z did
>> not allow the name to be claimed by this machine.
>>
>> Data: (with Words chosen instead of bytes)
>> 0000: 00000000 00560004 00000000 c00010e1
>> 0010: 00000101 c0000001 00000119 00000000
>> 0020: 00000000 00000000
>>
>> I cannot find anything on the Internet regarding this. Any help
>> would be greatly appreciated as I'd like to continue my sp1 rollout.