none
Event ID: 36888 Event Source: Schannel

    Question

  • I have read through many posts on this topic but no solutions. the server is a 2008 R2 functining as a terminal server.

    Log Name:      System
    Source:        Schannel
    Date:          6/21/2011 10:49:18 AM
    Event ID:      36888
    Task Category: None
    Level:         Error
    Keywords:     
    User:          SYSTEM
    Computer:      CMHA-MAIN-TERM.cmha.local
    Description:
    The following fatal alert was generated: 10. The internal error state is 10.
    Event Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
      <System>
        <Provider Name="Schannel" Guid="{1F678132-5938-4686-9FDC-C8FF68F15C85}" />
        <EventID>36888</EventID>
        <Version>0</Version>
        <Level>2</Level>
        <Task>0</Task>
        <Opcode>0</Opcode>
        <Keywords>0x8000000000000000</Keywords>
        <TimeCreated SystemTime="2011-06-21T14:49:18.286902000Z" />
        <EventRecordID>40393</EventRecordID>
        <Correlation />
        <Execution ProcessID="832" ThreadID="876" />
        <Channel>System</Channel>
        <Computer>CMHA-MAIN-TERM.cmha.local</Computer>
        <Security UserID="S-1-5-18" />
      </System>
      <EventData>
        <Data Name="AlertDesc">10</Data>
        <Data Name="ErrorState">10</Data>
      </EventData>
    </Event>

    Tuesday, June 21, 2011 3:08 PM

Answers

  • Hi,

     

    This Event ID 36888 occurs if a user tries to access a web site using HTTP but specifies an SSL port in the URL. For example, http://hostname or https://hostname.

     

    If some user access the website with the URL http://hostname:443, then this event will be logged. You can check the Schannel tracing log to confirm the scenario.

     

    If no issue is found, you can simply disable this Schannel event logging by changing the following registry value to 0.

     

    HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SecurityProviders\SCHANNEL\EventLogging

     

    For more information, please refer to the following link:

     

    How to enable Schannel event logging in IIS

    http://support.microsoft.com/kb/260729

     

    Regards,

     

    Arthur Li

     TechNet Subscriber Support  in forum

    If you have any feedback on our support, please contact  tngfb@microsoft.com . 


    Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.
    Wednesday, June 22, 2011 6:45 AM
    Moderator

All replies

  • Hi,

     

    This Event ID 36888 occurs if a user tries to access a web site using HTTP but specifies an SSL port in the URL. For example, http://hostname or https://hostname.

     

    If some user access the website with the URL http://hostname:443, then this event will be logged. You can check the Schannel tracing log to confirm the scenario.

     

    If no issue is found, you can simply disable this Schannel event logging by changing the following registry value to 0.

     

    HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SecurityProviders\SCHANNEL\EventLogging

     

    For more information, please refer to the following link:

     

    How to enable Schannel event logging in IIS

    http://support.microsoft.com/kb/260729

     

    Regards,

     

    Arthur Li

     TechNet Subscriber Support  in forum

    If you have any feedback on our support, please contact  tngfb@microsoft.com . 


    Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.
    Wednesday, June 22, 2011 6:45 AM
    Moderator
  • Hi,

     

    I would like to confirm what is the current situation? If there is anything that I can do for you, please do not hesitate to let me know, and I will be happy to help.

     

    Regards,

     

    Arthur Li

     TechNet Subscriber Support  in forum

    If you have any feedback on our support, please contact tngfb@microsoft.com .


    Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.
    Monday, June 27, 2011 2:19 AM
    Moderator
  • Where is this "Schannel Tracing log"?
    Thursday, November 27, 2014 5:05 PM
  • Dear Artur Li,

     

    My question is if the “Event ID: 36888” can affect the performance of the PC or any other feature, when you are facing a lot of this errors daily.

     Thanks¡¡¡


    Tuesday, July 4, 2017 4:52 PM