Monthly Archives: October 2015

Event ID 4319 NetBIOS over TCP/IP with Dual Nic’s

We have received many alerts on the error Event ID 4319 as seen below.

Event log: System
Event Source: NetBT
Event ID: 4319
Message Contents: A duplicate name has been detected on the TCP network.
The IP address of the computer that sent the message is in the data.
Use nbtstat -n in a command window to see which name is in the Conflict state.
netbios-nbtstat

View of the nbtstat -n command result

The cause of this issue has been systems that have more than one network card, this is more common in laptops that will use a hardline in the office. you can see this by using the command ‘nbtstat -n’ multiple network cards have the same NetBIOS name.

To correct this behavior you could prevent both network cards from connecting at the same time, although that is not a viable tactic to us. What we have decided to do is disable NetBIOS over TCP/IP on the wireless card.  If you are doing this remotely you can run the following commands.

First you will need to know what the index number of your network card is, you can retrieve that with the following command.

wmic nicconfig get caption,index,TcpipNetbiosOptions
netbios-nicindex

View of the network cards and the index numbers

You can see the index number listed next to each network card name, in this case we are looking for the wireless card, that would be index number ‘2’. You can also see the TcpipNetbiosOptions column is showing a ‘0’, that means it is set to DHCP server options or fail over to enabled if DHCP has no options set. we will need the TcpipNetbiosOptions value to be ‘2’ to disable NetBIOS over TCP/IP, and with the index number we can run the following. (Change the index to the nic relevant to your issue.)

wmic nicconfig where index=2 call SetTcpipNetbios 2
netbios-settcpipnetbios

Result of setting NetBIOS over TCP/IP off.