locked
Event 3688, Schannel RRS feed

  • Question

  • At Windows 8 Enterprise RTM Build 9200 (August 1, 2012) Event Viewer I have an error:

    "A fatal alert was generated and sent to the remote endpoint. This may result in termination of the connection. The TLS protocol defined fatal error code is 51. The Windows SChannel error state is 900"

    - <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
    - <System>
      <Provider Name="Schannel"
    Guid
    ="{1F678132-5938-4686-9FDC-C8FF68F15C85}" />
      <EventID>36888</EventID>
      <Version>0</Version>
      <Level>2</Level>
      <Task>0</Task>
      <Opcode>0</Opcode>
      <Keywords>0x8000000000000000</Keywords>
      <TimeCreated SystemTime="2012-08-26T19:38:57.523272200Z" />
      <EventRecordID>2072</EventRecordID>
      <Correlation />
      <Execution ProcessID="644" ThreadID="7564" />
      <Channel>System</Channel>
      <Computer>office-pc</Computer>
      <Security UserID="S-1-5-18" />
      </System>
    - <EventData>
      <Data Name="AlertDesc">51</Data>
      <Data Name="ErrorState">900</Data>
      </EventData>

     </Event>

    Any help? Thank you!



    Sunday, August 26, 2012 8:35 PM

Answers

  • Hi,

    Today 8/29/2012 I used IE10 and "Event 3688, Schannel" is back

    It's "lsass.exe" with the new PID 816 on my Task Manager.

    After Restart, lsass.exe running with another ID, and SamSs but VaultSvc no.

    - <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
    - <System>
      <Provider Name="Schannel" Guid="{1F678132-5938-4686-9FDC-C8FF68F15C85}" />
      <EventID>36888</EventID>
      <Version>0</Version>
      <Level>2</Level>
      <Task>0</Task>
      <Opcode>0</Opcode>
      <Keywords>0x8000000000000000</Keywords>
      <TimeCreated SystemTime="2012-08-28T22:03:32.622844200Z" />
      <EventRecordID>3102</EventRecordID>
      <Correlation />
      <Execution ProcessID="816" ThreadID="7176" />
      <Channel>System</Channel>
      <Computer>office-pc</Computer>
      <Security UserID="S-1-5-18" />
      </System>
    - <EventData>
      <Data Name="AlertDesc">51</Data>
      <Data Name="ErrorState">900</Data>
      </EventData>
      </Event>


    Solution for this is to go at Internet options\Advanced\ and uncheck "Use TLS 1.0"








    Tuesday, August 28, 2012 10:02 PM

All replies


  • Hi,

    Please check which process has ProcessID "644".


    Nicholas Li

    TechNet Community Support

    Tuesday, August 28, 2012 7:45 AM

  • Hi,

    Please check which process has ProcessID "644".


    Nicholas Li

    TechNet Community Support

    Hi. Got exactly the same error message except Process ID is 704. This is the

    • 'Local Security Authority Process'

    with the following sup processes:

    • Credential Manager
    • Netlogon
    • Security Accounts Manager

    Hope this helps you to help us :)

    Tuesday, August 28, 2012 11:00 AM
  • Hi,

    There is no PID "644" at Task Manager (Details/Services).

    My first Event 3688 started after fresh Windows 8 RTM install on 8/21/2012 and the last one on 8/27/2012.

    I am still waiting another one.


    It is possible to be from Internet Explorer 10? Because on 8/28/2012 I have not used IE10. 



    Tuesday, August 28, 2012 8:37 PM
  • Hi,

    Today 8/29/2012 I used IE10 and "Event 3688, Schannel" is back

    It's "lsass.exe" with the new PID 816 on my Task Manager.

    After Restart, lsass.exe running with another ID, and SamSs but VaultSvc no.

    - <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
    - <System>
      <Provider Name="Schannel" Guid="{1F678132-5938-4686-9FDC-C8FF68F15C85}" />
      <EventID>36888</EventID>
      <Version>0</Version>
      <Level>2</Level>
      <Task>0</Task>
      <Opcode>0</Opcode>
      <Keywords>0x8000000000000000</Keywords>
      <TimeCreated SystemTime="2012-08-28T22:03:32.622844200Z" />
      <EventRecordID>3102</EventRecordID>
      <Correlation />
      <Execution ProcessID="816" ThreadID="7176" />
      <Channel>System</Channel>
      <Computer>office-pc</Computer>
      <Security UserID="S-1-5-18" />
      </System>
    - <EventData>
      <Data Name="AlertDesc">51</Data>
      <Data Name="ErrorState">900</Data>
      </EventData>
      </Event>


    Solution for this is to go at Internet options\Advanced\ and uncheck "Use TLS 1.0"








    Tuesday, August 28, 2012 10:02 PM

  • Glad to know the issue has been resolved. Thanks for sharing the resolution.

    In the future, if you experience any issues regarding our products or if you have any feedbacks, you are also welcome to post a new thread in our forum. It is always our pleasure to be of assistance.

    Have a nice day!


    Nicholas Li

    TechNet Community Support

    Wednesday, August 29, 2012 1:49 AM
  • Question is, should TLS 1.0 be unchecked?  What are the repercussions?

    For reference, a previous thread:

    http://social.technet.microsoft.com/Forums/en-US/W8ITProPreRel/thread/9dfb4d09-8096-40c9-ac75-1e23f75417c9

    Wednesday, August 29, 2012 6:24 AM
  • You're welcome, I hope IE10 Team to find a new solution for TLC 1.0, 1.1 and 1.2


    Wednesday, August 29, 2012 10:49 AM