Schannel error, Event ID 36888? - IS there a way to Identify what causes Schannel to log error?
hi, hope correct forum problem,
i seeing few of these errors (error details below) sporadically throughout system event log on windows 2008 r2 server. have seen number of threads schannel errors
http://social.technet.microsoft.com/forums/en-us/w7itprogeneral/thread/b2e0e110-f9ca-4113-8f4d-f20d6b39b8c7 http://social.technet.microsoft.com/forums/en-us/windowsserver2008r2general/thread/675864e2-2856-44fa-b3bc-ef275d391d45however can find no clear way of trying find causing error. appear schannel logging errors errors being caused other processes. know ssl/tls related. question/s this.
what schannel , do?
how identify actual problem.?
i list error details below, pid refereced in error lssas.exe believe deals authentication. there anyway trace causing issue?
for reference pid 604 noted below lsasss.exe
the general error is
following fatal alert generated: 10. internal error state 1203.
the details are
- system
- provider
[ name] schannel
[ guid] {1f678132-5938-4686-9fdc-c8ff68f15c85}
eventid 36888
version 0
level 2
task 0
opcode 0
keywords 0x8000000000000000
- timecreated
[ systemtime] 2010-06-18t04:51:41.830028400z
eventrecordid 10087
correlation
- execution
[ processid] 604
[ threadid] 3828
channel system
computer <computernameremoved>
- security
[ userid] s-1-5-18
- eventdata
alertdesc 10
errorstate 1203
the reference above isn't specifically clear on changing. value eventlogging
hklm\system\currentcontrolset\control\securityproviders\schannel
value name: eventlogging
value type: reg_dword
value data: 7
the default one, makes schannel bit chatty start with. if can tie event specific site connecting to, want make sure certificate on site appropriate site.
the error 1203 indicates invalid clienthello client - enabling more verbose logging may reveal server responding way , provide additional information. reviewing other cases indicated multiple certificates server authentication on web server generating response on client.
Windows Server > Directory Services
Comments
Post a Comment