locked
Duplicate name on network (nbtstat -n) - duplicate user? RRS feed

  • Question

  • We are using Windows 2003 servers and SCOM to monitor these. On a regular basis, SCOM warnings like this get logged:

    Duplicate name on network  Alert Description
      
    Source:  Microsoft(R) Windows(R) Server 2003, Standard Edition  Another machine has sent a name release message to this machine probably because a duplicate name has been detected on the TCP network. The IP address of the node that sent the message is in the data. Use nbtstat -n in a command window to see which name is in the Conflict state. 
    Path:  pcname\Microsoft(R) Windows(R) Server 2003, Standard Edition  
    Alert Rule:  Duplicate computer name was detected  
    Created:  05/08/2009 11:27:04

    (eventvwr: Another machine has sent a name release message to this machine probably because a duplicate name has been detected on the TCP network.  The IP address of the node that sent the message is in the data. Use nbtstat -n in a command window to see which name is in the Conflict state.)

    When I check what the duplicate name might be, it always returns a Conflict with the Logged on user. Which puzzles me. How can this be?
    (so no duplicate computer name for sure, but a duplicate user...)

    Thnx

    Monday, August 10, 2009 10:50 AM

All replies

  • There could be several reasons:

  • There is a computer on the network with the same name.
  • An identical user name is logged on to multiple computers.
  • There are inactive or duplicate names in the Windows Internet Naming Service (WINS) database.
  • There is corruption in the Dynamic Host Configuration Protocol (DHCP) database.
  • There are conflicting network adapters in a multihomed computer.
  • The ipconfig /all command returns an incorrect host name.
  • Computer on the Network with the Same Name

    Use the nbtstat -n command to see the name of the computer in the conflict state. The IP address of the node that sent the message is in the data that this command returns. The following example shows what the data may look like in one of these events:

    Offset 28 is the IP address of the computer requesting name release. To determine the decimal IP address, invert the four hexadecimal numbers and convert them to decimal numbers separated by periods. Using this method, the IP address of E7 1A 65 16 becomes 22.101.26.231.

    The status column of the nbtstat output for the computer in conflict should contain either "Conflict" or "Released."

    You can run the nbtstat -a command with the IP address to get the computer name.

    Identical User Name Logged on to Multiple Computers

    The user names will register with a <03h>, and that will be the name in conflict. Ask the user to log off of all computers and log back on to just one computer.

    Inactive or Duplicate Names in the WINS Database

    Ask your system administrator to check the database to verify that there are no duplicate entries by deleting the static mapping in the WINS server. To do so, use the following steps:

    1. On the WINS server computer, start the WINS Manager.
    2. Click Mappings, click Static Mappings, and then click the entry that corresponds to your computer.
    3. Click Delete Mapping, and then click close.
    4. Restart your Windows XP-based computer (not the WINS server).

    Corruption in the DHCP Database

    For a possibly corrupted DHCP database, clear DHCP related entries in the registry, delete any .mib files, and then reinstall DHCP. It may be possible, if you reinstalled without cleaning out old settings in the registry, that the entries that cause the behavior are still there.

    Conflicting Network Adapters in a Multihomed Computer

    Other computers on the network may indicate that the multihomed computer's second card is in conflict with its first. Those computers then send the name release message.

    "IPCONFIG /ALL" Returns Incorrect Host Name

    Edit the registry, and change the computer name in the TCP/IP parameters section:

    1. Start Registry Editor (Regedit.exe), and locate the HOSTNAME value in the following subkey:
      HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip \Parameters
    2. Double-click the HOSTNAME value, and then edit the string data.

    Let us know is this has helped.


    Certifications: MCSA 2003 MCSE 2003

Monday, August 10, 2009 6:02 PM
  • Well, I mentioned it's not a duplicate computer. I did say the Conflict is a User. And yes, those are usually users logged onto multiple computers. Which is normal for us admins, I can't imagine being only logged on to 1 computer. So, while the error: An identical user name is logged on to multiple computers. *is* correct, I don't see the problem with it. And, then I would expect this error *a lot*, but it only happens a few times a day (max), on different servers every time... Any ideas? Thnx
    Tuesday, August 11, 2009 10:00 AM