Schannel error, Event ID 36888? - IS there a way to Identify what causes Schannel to log error?

hi, hope correct forum problem,

i seeing few of these errors (error details below) sporadically throughout system event log on windows 2008 r2 server. have seen number of threads schannel errors

http://social.technet.microsoft.com/forums/en-us/w7itprogeneral/thread/b2e0e110-f9ca-4113-8f4d-f20d6b39b8c7

http://social.technet.microsoft.com/forums/en-us/forefrontedgegeneral/thread/92c63737-c2a3-41f7-8878-3b0cf5ee95ff/

http://social.technet.microsoft.com/forums/en-us/windowsserver2008r2general/thread/675864e2-2856-44fa-b3bc-ef275d391d45

 http://social.technet.microsoft.com/forums/en-us/windowsserver2008r2general/thread/4b505150-c709-45a2-b9f3-abc7c9988d6a

http://social.technet.microsoft.com/forums/en-us/forefrontedgegeneral/thread/80b1ceee-9835-4f78-af0f-5b00a8964f34

however can find no clear way of trying find causing error. appear schannel logging errors errors being caused other processes. know ssl/tls related. question/s this.

what schannel , do?

how identify actual problem.?

i list error details below, pid refereced in error lssas.exe believe deals authentication. there anyway trace causing issue?

for reference pid 604 noted below lsasss.exe

the general error is
    following fatal alert generated: 10. internal error state 1203.

the details are

- system

  - provider

   [ name]  schannel
   [ guid]  {1f678132-5938-4686-9fdc-c8ff68f15c85}
 
   eventid 36888
 
   version 0
 
   level 2
 
   task 0
 
   opcode 0
 
   keywords 0x8000000000000000
 
  - timecreated

   [ systemtime]  2010-06-18t04:51:41.830028400z
 
   eventrecordid 10087
 
   correlation
 
  - execution

   [ processid]  604
   [ threadid]  3828
 
   channel system
 
   computer <computernameremoved>
 
  - security

   [ userid]  s-1-5-18
 

- eventdata

  alertdesc 10
  errorstate 1203

the reference above isn't specifically clear on changing. value eventlogging

hklm\system\currentcontrolset\control\securityproviders\schannel
value name: eventlogging
value type: reg_dword
value data: 7

the default one, makes schannel bit chatty start with. if can tie event specific site connecting to, want make sure certificate on site appropriate site.

the error 1203 indicates invalid clienthello client - enabling more verbose logging may reveal server responding way , provide additional information. reviewing other cases indicated multiple certificates server authentication on web server generating response on client.

Windows Server  >  Directory Services