I am seeing two events logged back to back occasionally (together) 36874 and 36888 both Schannel errors. The processID is linked to LSASS.exe according to task manager. I have done some searching but can't seem to find a resolution: Server 2008 R2 Standard Log Name: System Source: Schannel Date: 7/31/2012 1:18:00 AM Event ID: 36888 Task Category: None Level: Error Keywords: User: SYSTEM Computer: DMZ Description: The following fatal alert was generated: 40. The internal error state is 1205. Event Xml: <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"> <System> <Provider Name="Schannel" Guid="{1F678132-5938-4686-9FDC-C8FF68F15C85}" /> <EventID>36888</EventID> <Version>0</Version> <Level>2</Level> <Task>0</Task> <Opcode>0</Opcode> <Keywords>0x8000000000000000</Keywords> <TimeCreated SystemTime="2012-07-31T05:18:00.417513700Z" /> <EventRecordID>83699</EventRecordID> <Correlation /> <Execution ProcessID="500" ThreadID="4936" /> <Channel>System</Channel> <Computer>RTDMZ1</Computer> <Security UserID="S-1-5-18" /> </System> <EventData> <Data Name="AlertDesc">40</Data> <Data Name="ErrorState">1205</Data> </EventData> </Event> ************** Log Name: System Source: Schannel Date: 7/31/2012 1:18:00 AM Event ID: 36874 Task Category: None Level: Error Keywords: User: SYSTEM Computer: DMZ Description: An TLS 1.0 connection request was received from a remote client application, but none of the cipher suites supported by the client application are supported by the server. The SSL connection request has failed. Event Xml: <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"> <System> <Provider Name="Schannel" Guid="{1F678132-5938-4686-9FDC-C8FF68F15C85}" /> <EventID>36874</EventID> <Version>0</Version> <Level>2</Level> <Task>0</Task> <Opcode>0</Opcode> <Keywords>0x8000000000000000</Keywords> <TimeCreated SystemTime="2012-07-31T05:18:00.417513700Z" /> <EventRecordID>83698</EventRecordID> <Correlation /> <Execution ProcessID="500" ThreadID="4936" /> <Channel>System</Channel> <Computer>RTDMZ1</Computer> <Security UserID="S-1-5-18" /> </System> <EventData> <Data Name="Protocol">TLS 1.0</Data> </EventData> </Event>

Hi Ryan, Thanks for posting in Microsoft TechNet forums. If everything is working fine, it is OK that we just turn off these two error reporting (36874 and 36888). We can check the information in this thread: Getting Schannel 36874 errors on my CAS/HT servers http://social.technet.microsoft.com/Forums/en-US/exchange2010/thread/7b95a21c-67fc-49a9-8198-b9e364523d27/ Also here is an article which might provide some idea regarding how to resolve the issue: SSL Handshake Error with Windows Server 2008 R2 (SSRS) and Windows XP http://www.networksteve.com/forum/topic.php/SSL_Handshake_Error_with_Windows_Server_2008_R2_(SSRS)_and_Windo/?TopicId=23672&Posts=5 (Note: Since the site is not hosted by Microsoft, the link may change without notice. Microsoft does not guarantee the accuracy of this information.) Regards Kevin

Hi Ryan, Thanks for posting in Microsoft TechNet forums. If everything is working fine, it is OK that we just turn off these two error reporting (36874 and 36888). We can check the information in this thread: Getting Schannel 36874 errors on my CAS/HT servers http://social.technet.microsoft.com/Forums/en-US/exchange2010/thread/7b95a21c-67fc-49a9-8198-b9e364523d27/ Also here is an article which might provide some idea regarding how to resolve the issue: SSL Handshake Error with Windows Server 2008 R2 (SSRS) and Windows XP http://www.networksteve.com/forum/topic.php/SSL_Handshake_Error_with_Windows_Server_2008_R2_(SSRS)_and_Windo/?TopicId=23672&Posts=5 (Note: Since the site is not hosted by Microsoft, the link may change without notice. Microsoft does not guarantee the accuracy of this information.) Regards Kevin