Fix 0X0000097E: Client Already Registered for Alert Event

When this error shows up

You're running a monitoring tool or a script that uses the NetAlertRegister API to subscribe to system events (like service failures or disk errors). Everything's fine until you restart that tool or switch user contexts. Then you get error 0X0000097E — which maps to NERR_AlertExists (error code 2430 in decimal). The message: "The specified client is already registered for the specified event."

This can happen with backup agents, log aggregators, or custom PowerShell scripts that call Register-EngineEvent or similar low-level alert functions. The trigger is almost always a service or process that crashed without unregistering, then tried to register again on restart.

Root cause

What's actually happening here is that Windows's NetAlert service (part of the Server Service and NetLogon infrastructure) maintains an internal table of client registrations. Each registration includes a client name and an event type. When a client calls NetAlertRegister with a name that's already in that table — even if the original process is dead — Windows returns NERR_AlertExists.

The system doesn't automatically clean up orphaned registrations. A crashed process leaves its entry behind. So next time you start the same tool, it sees the stale entry and refuses to register. That's the real fix — you have to clear that stale entry.

The fix

Skip reinstalling your software or rebooting the whole machine. That's overkill. Here's the targeted approach:

Step 1: Find the stale registration

Open an elevated Command Prompt (run as admin). Use net config server to see current alert recipients. But that only lists logged-in users, not the internal registration table. For the real data, we dig into the registry.

reg query "HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" /v AlertNames

This shows the AlertNames multi-string value. That's where client names are stored. If you see your tool's name there (or a leftover from a previous install), that's the culprit.

Step 2: Remove the duplicate entry

Back up the key first:

reg export "HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" C:\alert_backup.reg

Then remove the specific client name. If it's the only entry, you can clear the whole value:

reg delete "HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" /v AlertNames /f

If there are multiple names and you only want to remove one, you'll need to use PowerShell to edit the multi-string value:

$path = "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters"
$current = (Get-ItemProperty -Path $path).AlertNames
$new = $current | Where-Object {$_ -ne "YourClientName"}
Set-ItemProperty -Path $path -Name AlertNames -Value $new

Replace YourClientName with the actual client name from your error context.

Step 3: Restart the alert service

Changes won't take effect until you restart the Server service. In Command Prompt (admin):

net stop server && net start server

This can disrupt file sharing for a moment. If you can't afford that, schedule it during a maintenance window. Alternatively, restart only the Workstation service if your issue is only on the client side (net stop workstation && net start workstation).

The reason step 3 works is that the Server service maintains the alert table in memory. Restarting it clears that table and forces a re-read from the registry. Same effect as a full reboot, but much faster.

If it still fails

If the error persists after these steps, check these:

• Check for hidden processes: Run tasklist /svc and look for your tool running in a different session. Use tasklist /fi "SERVICES eq yourservice" to see if the service is already active under a different PID.
• Verify the registry key restoration: After restarting the service, re-run the reg query command. If the value reappears automatically, something (like Group Policy or a startup script) is re-adding it. Check gpedit.msc under Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options for any "Alert"-related policies.
• Check for antivirus interference: Some security software hooks into the alerting subsystem. Temporarily disable yours to test. If that fixes it, add an exception for your tool.
• Third-party conflict: Tools like PRTG, Nagios agents, or even Lenovo's ThinkPad Power Manager have been known to register alert clients. Use netstat -ano | findstr :445 to see if another process is listening on the alert port (445 for SMB/NetBIOS).

Still stuck? You can always nuke the registry key and restart the service one more time. That's the nuclear option — it wipes all alert registrations, including legitimate ones. But it works when nothing else does.