Security Event 5061 Source: System Integrity AND System Event 36888 Source: Schanell
Hello,
W2K8 R2 SP1 + EX2010 SP1 RU5
Can anyone point me to some direction, what should I look if I'm getting errors like below:
I thint, that this error is somehow related to ActiveSync clients but I'm not sure.
ActiveSync uses external trusted SAN SSL certificate. Client certs are not required.
Security:------------------------------------------
Cryptographic operation.
Subject:
Security ID: SYSTEM
Account Name: SRV02$
Account Domain: KOPLI
Logon ID: 0x3e7
Cryptographic Parameters:
Provider Name: Microsoft Software Key Storage Provider
Algorithm Name: RSA
Key Name: le-19e33802-f1a3-4473-a819-b14e7ae0a65c
Key Type: Machine key.
Cryptographic Operation:
Operation: Decrypt.
Return Code: 0x80090027
System: Schanell ------------------------------------------
The following fatal alert was generated: 20. The internal error state is 960.
rgds Sven
October 11th, 2011 3:04am
Hi,
Please have a look at the following threads:
Error 36888 Schannel
http://social.technet.microsoft.com/Forums/en-CA/winservergen/thread/55d1de30-f87e-4fc9-9173-7c9cabfa7d00
Schannel error, Event ID 36888? - IS there a way to Identify what causes Schannel to log error?
http://social.technet.microsoft.com/Forums/en/winserverDS/thread/4c5430f5-43f6-41b4-97d3-03cfb3efa70b
Hope it helps.
Regards,
Bruce
Free Windows Admin Tool Kit Click here and download it now
October 20th, 2011 3:14am
Those links gives me some idea, but no solution.
I'm so far, that I found this Key name: "le-19e33802-f1a3-4473-a819-b14e7ae0a65c" resides in one file in my computer in
following directory: c:\ProgramData\Microsoft\Crypto\RSA\MachineKeys
If I understand right, there are encrypted private keys? So.. it must be somehow related to certificates?
What certificate? Who is accessing those keys? And why error? User: SYSTEM has sufficent access to this file.rgds Sven
October 21st, 2011 5:41am
Anybody..?rgds Sven
Free Windows Admin Tool Kit Click here and download it now
November 10th, 2011 5:03am
Still nothing?rgds Sven
November 28th, 2011 4:07am
Schannel
[
Guid]
{1F678132-5938-4686-9FDC-C8FF68F15C85}
EventID
36888
Version
0
Level
2
Task
0
Opcode
0
Keywords
0x8000000000000000
-
TimeCreated
[
SystemTime]
2012-10-06T23:15:38.547200000Z
EventRecordID
83903
Correlation
-
Execution
[
ProcessID]
908
[
ThreadID]
964
Channel
System
Computer
rob-PC
-
Security
[
UserID]
S-1-5-18
-
EventData
AlertDesc
70
ErrorState
105 Yep ,I got it also!
Free Windows Admin Tool Kit Click here and download it now
October 6th, 2012 7:22pm