none
Event ID 36887 error

    Question

  • Hi all,

    After boot-up this error showed up in the System Event Log :

    Source : system  Event ID: 36887  " the following fatal alert was recieved :47

    I researched it and from what I understand it may be a security certificate issue??  I havent installed any new programs or hardware, The computer is part of a workgroup not a domain.  checked Windows update... computer fully updated.  I did a complete shutdown... waited 5 to 10 min and restarted and the error didnt show up.  I was curious on what this error means. I sent detailed feedback to Microsoft and also copied the details of the error here. Anyone else have this error?



    System
    - Provider
    [ Name] Schannel
    [ Guid] {1F678132-5938-4686-9FDC-C8FF68F15C85}
    EventID 36887
    Version 0
    Level 2
    Task 0
    Opcode 0
    Keywords 0x8000000000000000
    - TimeCreated
    [ SystemTime] 2009-03-02T13:18:52.866643400Z
    EventRecordID 7757
    Correlation
    - Execution
    [ ProcessID] 524
    [ ThreadID] 560
    Channel System
    Computer Windows7-PC
    - Security
    [ UserID] S-1-5-18
    - EventData
    AlertDesc 47
    Monday, March 02, 2009 2:46 PM

Answers

  • hi,

    thx for the input....


    I will monitor the processes and see what happens. So far the error hasnt reoccured. Strange!
    maybe just a wierd monday glitch  :-)


    if I figure it out... will post :-)

    thx again
    Monday, March 02, 2009 5:25 PM

All replies

  • I couldn't find anything significant in my searches either.  I'd suggest monitoring the process to see if it recurs.  FWIW, check the process with PID 524 (Task Manager...Processes tab...View...Select Columns...PID

    Be aware that the current PID may not be the same as the PID was when the error happened.  But until you can reproduce it, it's the best bet that you've got.

    You can also use this free tool to examine the Threads within that process, and may be able to locate the TID (Thread ID) of 560 in there.  FYI - this is even less reliable than the PID - but as there's no other evidence at this point it's either that or wait for the error to recur.
    - John
    • Proposed as answer by Ibrahim AKAY Wednesday, October 24, 2012 9:39 AM
    • Unproposed as answer by Ibrahim AKAY Wednesday, October 24, 2012 9:39 AM
    Monday, March 02, 2009 4:33 PM
    Answerer
  • hi,

    thx for the input....


    I will monitor the processes and see what happens. So far the error hasnt reoccured. Strange!
    maybe just a wierd monday glitch  :-)


    if I figure it out... will post :-)

    thx again
    Monday, March 02, 2009 5:25 PM
  • I am seeing the same error posted at the top of the page.  If there is any information that I can add to help figure this out please let me know.  I will look for this to happen again and see what the process is.  It happened about 29 times in a row and right now process 572 is lsass.exe.  This happened about 4 hours ago and I have not rebooted since.

    Log Name:      System
    Source:        Schannel
    Date:          6/22/2009 6:13:22 PM
    Event ID:      36887
    Task Category: None
    Level:         Error
    Keywords:     
    User:          SYSTEM
    Computer:      MainBrain
    Description:
    The following fatal alert was received: 47.
    Event Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
      <System>
        <Provider Name="Schannel" Guid="{1F678132-5938-4686-9FDC-C8FF68F15C85}" />
        <EventID>36887</EventID>
        <Version>0</Version>
        <Level>2</Level>
        <Task>0</Task>
        <Opcode>0</Opcode>
        <Keywords>0x8000000000000000</Keywords>
        <TimeCreated SystemTime="2009-06-22T22:13:22.660773400Z" />
        <EventRecordID>2802</EventRecordID>
        <Correlation />
        <Execution ProcessID="572" ThreadID="608" />
        <Channel>System</Channel>
        <Computer>MainBrain</Computer>
        <Security UserID="S-1-5-18" />
      </System>
      <EventData>
        <Data Name="AlertDesc">47</Data>
      </EventData>
    </Event>
    Tuesday, June 23, 2009 2:14 AM
  • You are apparently not alone. See http://www.sevenforums.com/drivers/8900-event-id-36874-a.html

    "Further testing shows IE8 x64 on my desktop has the problem along with IE8 x86 on my laptop. Firefox does not show any errors so I am guessing it is a IE 8 issue."

    Try another browser perhaps to see if you can isolate it as an IE8 issue.

    Also, you may want to run the Microsoft Process Explorer to see what is truiggering the error.

    Details at http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx

    Gib
    Tuesday, June 23, 2009 6:28 PM
  • I am see a similar issue. Are you getting a fatal error and a crash?
    Is Google Chrome installed?

    I found this:

    http://code.google.com/p/chromium/issues/detail?id=18744 
    Wednesday, August 26, 2009 4:59 PM
  • I was facing a similar issue in windows 7 beta version but the problem was related to a coonfiguration i made in the group policy object under networking setting i manually set the SSL cryptographic i desired to run only...
    and i forgot to add a essential one (newbie kind of thing) and also on the IE advanced internet options i set to use only TLS 1.1 and 1.2 and forgot to check the 1.0...
    so maybe its the same problem try reseting IE8 settings to see if it solves this issue!!
    hope this helps as a refernce..
    Kind regards,
    RR
    Wednesday, August 26, 2009 7:51 PM
  • I also have same issue. Any luck how to fix it? My system freshly installed and there is no any one single 3rd party program.
    Monday, January 04, 2010 2:23 AM
  • Hello,

    I'm having the same problem at my Windows 2008 R2 + Exchange Server 2010.
    More detailed: The following fatal alert was received: 42.

    It started after applying a new (self-signed) certificate at my OWA. 

    I figured out that it happens when a user tries to connect to his OWA using Mozilla FireFox.  FireFox notifies that this self-signed certificate is not trusted.  At that point, my server notifies me this error. When the user adds an exception for this self-signed certificate, the errors at my server (!) don't come back. 

    It's very strange to receive an user-caused error at my servers' system-event-viewer...but good to know. 

    Maybe interesting to fix in an update? 

    Thanks,

    Thomas Hoste

     

    Thursday, May 27, 2010 4:02 PM
  • I am testing a new 2008 x64 Bit R2 build with Citrix 6.0 running and I see this in the event logs as a user is making an TCP-RDP and TCP-ICA connection to the server

     

    Log Name:      System
    Source:        Schannel
    Date:          6/21/2010 8:48:28 AM
    Event ID:      36887
    Task Category: None
    Level:         Error
    Keywords:      
    User:          SYSTEM
    Computer:      <server_name>
    Description:
    The following fatal alert was received: 40.
    Event Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
      <System>
        <Provider Name="Schannel" Guid="{1F678132-5938-4686-9FDC-C8FF68F15C85}" />
        <EventID>36887</EventID>
        <Version>0</Version>
        <Level>2</Level>
        <Task>0</Task>
        <Opcode>0</Opcode>
        <Keywords>0x8000000000000000</Keywords>
        <TimeCreated SystemTime="2010-06-21T12:48:28.758224400Z" />
        <EventRecordID>4014</EventRecordID>
        <Correlation />
        <Execution ProcessID="952" ThreadID="272" />
        <Channel>System</Channel>
        <Computer><server_name></Computer>
        <Security UserID="S-1-5-18" />
      </System>
      <EventData>
        <Data Name="AlertDesc">40</Data>
      </EventData>
    </Event>

    Monday, June 21, 2010 1:21 PM
  • Found Event ID 36887 on my Windows 7 machine today.

    Found also the cause in my case: It happens immediately when I open w https Connection to a Cisco VPN Concentrator device, running with a Cisco self-signed SSL-certificate, using IE8.

    Maybe this is helpful for you. Eventuelly, e.g., the Citrix also has some kind of self-signed certificate.

    Regards,

    Michael

    Friday, July 16, 2010 5:13 PM
  • Hey All,

    I also am seeing this error, and I have been able to narrow it down to an internal HTTPS website. I can instantly reproduce the error in the event log. I will now need to work with the certificate folks to see if we can trace the reason as to why it is happening.

    Will do my best to keep you updated.

    Travis

    Wednesday, October 13, 2010 3:13 AM
  • Hi all. 

    I have the same exception. I created a Windows Service which makes a HTTPS request every 15 min and I get this event error. I switched to HTTP and the error stops.

    Has anybody figured out what this event error is? 

     

     

    Wednesday, October 27, 2010 10:00 AM
  • I have the following error in my event logs and there are quite a few of them.

    The following fatal alert was generated: 10. The internal error state is 10.

    Whenever Microsoft Silverlight runs Internet Explorer hangs

    I previously posted this question and the referenced Microsoft information indicated that it was a security issue but that it was nothing to worry about. However having so many fatal alerts I feel maybe dragging down my system. I'm experiencing Internet Explorer hanging on a regular basis and trying to determine what may be causing a problem.

    I understand that I'm able to modify the registry in order to make as Schannel less chatty I would preferred understand why these fatal alerts are being generated. and what I can do to resolve the underlying problem

    I'm running Windows 7 ultimate 64-bit and Norton Internet security as well as malware bites.

    Thanks,

    Steve

    SteveUwashere.
    Monday, January 03, 2011 7:57 PM
  • Did anyone ever anser your question about this, my settup is the exact same
    Friday, January 28, 2011 8:30 PM
  • Did anyone ever anser your question about this, my settup is the exact same

    Its been only 2 years since this post opened! I think we have to wait another 2 years to get an answer from the microsoft. They are very busy to collect the monies from us!
    Saturday, January 29, 2011 6:14 AM
  • Dear Thomas,

    My exchange server is also generating same error.Did u managed to find any fix.

    Thanks,

    Eagleash

    Monday, September 26, 2011 10:16 AM
  • As I could not find a fix, I've used a temporary solution which works for me - disable schannel event logging.

    Windows Registry Editor Version 5.00

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL]
    "EventLogging"=dword:00000000

    Value Description
    0x0000  Do not log
    0x0001  Log error messages
    0x0002  Log warnings
    0x0004  Log informational and success events

    • Edited by SelfMan Saturday, October 29, 2011 11:50 PM
    • Proposed as answer by SelfMan Saturday, October 29, 2011 11:51 PM
    Saturday, October 29, 2011 11:49 PM
  • ...or then again it is error with x64....firefox...ie8....loaded in combo..not playing well together...
    Saturday, October 13, 2012 9:15 PM
  • I know this is a long time after the fact.

    I had the same errors on my Windows Server 2008 R2.  (The following fatal alert was received: 40)
    It turned out that Adobe Flash Player Update Service service was trying to connect hourly to perform it's functions.

    The next two lines in the event log were Service Control Manager reporting the above service entered the running state.

    I uninstalled the Adobe Software Update Service and the problem ceased.

    I believe it was trying to establish a secure connection behind our firewall without proxy credentials and logging the error.


    • Edited by Mickin2000 Thursday, February 21, 2013 5:51 PM
    Thursday, February 21, 2013 5:50 PM