locked
Event Error of Source:Schannel Event ID:36888 RRS feed

  • Question

  • Hi,

    I have an Exchange 2007 server installed on Windows Server 2008 R2.

    I find many Event Error of Source:Schannel Event ID:36888,

    the following is the details:

    Log Name:      System
    Source:        Schannel
    Date:          8/3/2010 9:47:41 AM
    Event ID:      36888
    Task Category: None
    Level:         Error
    Keywords:     
    User:          SYSTEM
    Computer:      MailBox.DomainName.local
    Description:
    The following fatal alert was generated: 10. The internal error state is 1203.
    Event Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
      <System>
        <Provider Name="Schannel" Guid="{1F678132-5938-4686-9FDC-C8FF68F15C85}" />
        <EventID>36888</EventID>
        <Version>0</Version>
        <Level>2</Level>
        <Task>0</Task>
        <Opcode>0</Opcode>
        <Keywords>0x8000000000000000</Keywords>
        <TimeCreated SystemTime="2010-08-03T01:47:41.433593200Z" />
        <EventRecordID>4982</EventRecordID>
        <Correlation />
        <Execution ProcessID="576" ThreadID="8140" />
        <Channel>System</Channel>
        <Computer>MailBox.DomainName.local</Computer>
        <Security UserID="S-1-5-18" />
      </System>
      <EventData>
        <Data Name="AlertDesc">10</Data>
        <Data Name="ErrorState">1203</Data>
      </EventData>
    </Event>

    would you please tell me how to fix it

    Thanks


    Frank@Hiweb 冯立超@瀚博资讯
    Tuesday, August 3, 2010 5:57 AM

Answers

  • Hi Frank,

    This event is seen on windows 2008 R2 running IIS.

    If a user tries to access a web site using HTTP but specifies an SSL port in the URL then this event is logged.

    For example, if your OWA address is https://mail.domain.com/owa, but one use enter the address

    http://mail.domain.com:443/owa, the event will be logged.

     


    Frank Wang
    • Marked as answer by Frank{at}Hiweb Thursday, August 5, 2010 10:01 AM
    • Unmarked as answer by Frank{at}Hiweb Thursday, August 5, 2010 10:04 AM
    • Marked as answer by emma.yoyo Tuesday, August 10, 2010 5:34 AM
    Thursday, August 5, 2010 9:13 AM

All replies

  • Hi,

    After full update this will be gone.

    So update your Windows as well exchange.

    Regards.

    Shafaquat Ali.


    M.C.I.T.P Exchange 2007/2010, M.C.I.T.P Windows Server 2008, M.C.T.S OCS Server 2007 R2, Phone: +923008210320
    • Proposed as answer by Shafaquat Ali Tuesday, August 3, 2010 9:37 AM
    Tuesday, August 3, 2010 7:45 AM
  • Thank you Shafaquat,

    I'm updating it now.

    but do you know which patch or kb is used for fix this issue?

    Regards.


    Frank@Hiweb 冯立超@瀚博资讯
    Tuesday, August 3, 2010 8:10 AM
  • Hi,

    I dont know that what it is but when I updated completely than this was gone and also I did not find any specific thing on google or bing as well

     

    Regards.

    Shafaquat Ali.


    M.C.I.T.P Exchange 2007/2010, M.C.I.T.P Windows Server 2008, M.C.T.S OCS Server 2007 R2, Phone: +923008210320
    Tuesday, August 3, 2010 8:31 AM
  • Hi,

     

    Sorry what updates did you apply, What Update Rollups have you installed?

     

    Thanks in advance.

     

    Wednesday, August 4, 2010 2:59 AM
  • Thank Shafaquat,

    I updated all the updates, but the error come again,  about once or twice one day, and every time two error come at same time.

     

     


    Frank@Hiweb 冯立超@瀚博资讯
    Thursday, August 5, 2010 1:00 AM
  • Hi Frank,

    This event is seen on windows 2008 R2 running IIS.

    If a user tries to access a web site using HTTP but specifies an SSL port in the URL then this event is logged.

    For example, if your OWA address is https://mail.domain.com/owa, but one use enter the address

    http://mail.domain.com:443/owa, the event will be logged.

     


    Frank Wang
    • Marked as answer by Frank{at}Hiweb Thursday, August 5, 2010 10:01 AM
    • Unmarked as answer by Frank{at}Hiweb Thursday, August 5, 2010 10:04 AM
    • Marked as answer by emma.yoyo Tuesday, August 10, 2010 5:34 AM
    Thursday, August 5, 2010 9:13 AM
  • Thank you Frank, that is the Answer.

    I have tested it by use http://mail.domain.com:443/owa, and get the event error.

    but i don't know why so many connection use http://...:443, is it some attack?

    thanks

     

     

     


    Frank@Hiweb 冯立超@瀚博资讯
    Thursday, August 5, 2010 10:08 AM
  • Hi Frank,

    You can check IIS logs to find some helpful information. You can find who(client IP) try to connect to OWA using port 80.

    By default, it is located in C:\inetpub\logs\logfiles\W3SVC1

    But since this is a known issue in Windows 2008 R2 with IIS. It is not unique to Exchange server.

    Maybe you can get more support from Windows server forum.


    Frank Wang
    Friday, August 6, 2010 2:02 AM
  • Dear Frank,

     

    Is visting a https site with "http://" prefix the only cause?

     

    Is it possible for there to be other causes of the problem?

     

    I experimented on my machine and found it happens with hotmail. It doesn't necessarily require one to type an URL from the address bar; even if I am just clicking links in hotmail (Inbox, Sent, Home, etc.), there will subsequently 36888 errors (several for each click/navigation) listed in Event Viewer.

     

    Have you ever seen this happen with hotmail? Do you know the reason?

     

     

     

    Thanks,

    Bob

    Wednesday, May 11, 2011 7:00 AM