Continuous "36888 Schannel Errors" in System Event Log when NOT connected to Internet

We are hoping someone will be able to assist with us this very strange issue please ?
We are using Windows 8.1 x64 Enterprise with Office 2013 and the latest Symantec Endpoint Proctecion v12.1.5 installed. They are managed using SCCM2012 in a large AD domain environment
When our workstations are NOT connected to the internet (only local intranet) the following errors appear in SYSTEM event log almost continuously (several times a minute).
Event ID:36888 User: SYSTEM OpCode:Info Level:Error Source:SChannel
"A fatal alert was generated and sent to the remote endpoint. This may result in termination of the connection. The TLS protocol defined fatal error code is 70. The Windows Schannel error state is 11."
The process associated with these events is "Local Security Authority Process"
When an internet connection is enabled for these machines these 36888 errors will suddenly stop !.
An event "Error 36887 "A fatal alert was received from the remote endpoint. The TLS protocol defined fatal alert code is 40." Is also occurring on these machines but only occasionally.
As a result, We suspect there must be a process continuously attempting to connect to an internet service and failing ?.
Some of the things we have tried so far;
- We have disabled all non-essential services (e.g. Windows Store Service) one by one but this didn't fix.
- We have tried disabling Tile updates on Start
- We have tried a bunch of different Group Policy settings to disable different combinations of TLS/SSL in IE config.
- We have searched the internet forums and tried some suggested fixes but this combination of error state and error code seems unique ?.
It doesn't happen on our Windows 7 x64 workstations that have much same apps & configuration.
Any advice or suggestions would be greatly appreciated !
Thanks.

Hi Makes006,
This Event ID 36888 occurs if a user tries to access a web site using HTTP but specifies an SSL port in the URL.
We can try clean boot to troubleshoot whether this issue is caused by a third party program .
How to perform a clean boot in Windows
http://support.microsoft.com/kb/929135
If there is no sensible impacts on operating the machines ,we can try to disable this log by modify the following registry key value to 0.
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SecurityProviders\SCHANNEL\EventLogging
For more information, please refer to the following link:
How to enable Schannel event logging in IIS
http://support.microsoft.com/kb/260729
Regards,
Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact [email protected]

Similar Messages

I can't download iTunes to my vista computer. Error message says that computer is not connected to internet, when it is.

I can't download iTunes to my vista computer. Error message says that computer is not connected to internet, when is is. Firewall allows iTunes.

This is a common issue, temporarily disable the Anti-Virus and Firewall software on the laptop.

I can not connect to Itune store and event tried to connect to support network and error message came up I am not connected to internet which I clearly am

Can anyone help. I cannot access Itunes it simply runs for ever without a error message. I tried to get on Itunes support today and not get an error message you are not connect to the internet.
I have already give permission of itune on firewall in windows, but this has zero effect
I have windows 7 (64bit), a BT hub and latest version onf Itune 64bit
I really want to use home sharing and get visuals for albumns etc

Where did you get this iPhone?
Was it new or second hand?
You have to sign out then sign in with the correct Apple ID and password.
Settings > iTunes & App Store > Apple ID: > do it here.

Unknown error (-42408) it says I'm not connected to internet?

I was able to download latest version of itunes but I cannot get into the store and when I clicked the HELP it said I'm not connected to the internet.
What is going on?

See Here for iTunes Store Connection Issues
http://www.apple.com/support/itunes/troubleshooting/

Windows 8 system doesn't get internet, says system event log on service has some problem of STOP 0xC000021A error which system restarts very slowly

Hi, my system runs on windows 8 on hp laptop envy series. All of a sudden, system event log on service stopped, errors which prevented the system to log on services. It displayed error of STOP 0xC000021A when i use system restore to roll back to previous
configuration. Also when I tried to refresh my pc, it says i can't do changes as log in was switched to prevent the changes by notification.I don't know what to do next, I tried to put recovery dvds which I made when system was bought, now not at all working.
Internet is not active, not able to resolve by trouble shooting and system taking lot of time to get dsktop. Previously I used to get my desktop in 10 seconds. Now its 10 min. May be I m infected with virus. My files, they are there. I tried to transfer some
files by pendrive to another system, now the new system(where i put my files in another system) crashed, windows 7 system which does not display desktop, icons etc and not at all workable.
Also in my hp system, i m unable to open control panel. if its opened, it will not go off, when i use task manager, it says explorer and shuts down. I had to force restart the system. Please resolve something to get my hp laptop workable. I m waiting for
my MS thesis to be working on that. My files are locked and no way to transfer, I fear of infected by virus to another computer also.
Pls give instructions to hw to set my hp laptop at the earliest without losing any of the files. Idon't want to reinstall and lose all the data for timebeing. Else, inform me the option for copying data safely. I tried to change the adv startup and recovery
by changing the boot sequence by DVD but this also shows error 0xC000021A and asks us to see the details. I didn't understand all this. Pls help asap.
Thanks
venkata
STOP 0xC000021A

MV
If you can boot either from the win 8 dvd or in safe mode we need the DMP files
We do need the actual DMP file as it contains the only record of the sequence of events leading up to the crash, what drivers were loaded, and what was responsible.
WE NEED AT LEAST TWO DMP FILES TO SPOT TRENDS AND CONFIRM THE DIAGNOSIS.
Please follow our instructions for finding and uploading the files we need to help you fix your computer. They can be found here
If you have any questions about the procedure please ask
Wanikiya and Dyami--Team Zigzag

NetBT 4321 Errors in Member Server's System Event Logs

Hi,
I've searched high and low and can't find a resolution to this issue. We have approximately 30 windows server 2003 servers, most R2, all SP2. We have 2 domain controllers - 10.0.0.10 & 10.0.0.11 (the first one holds the PDC role).
In the System event log of nearly all the member servers is the NetBT 4321 error, with the following text:
"The name "OURDOMAIN :1d" could not be registered on the Interface with IP address 10.0.0.43. The machine with the IP address 10.0.0.10 did not allow the name to be claimed by this machine."
On each machine the first IP mentioned is always that machine's IP (10.0.0.43 in this case), with the second one (the one not allowing 1d to be registered) being the PDC emulator's IP (10.0.0.10). Now I can understand why this is failing - these machines are all on the same subnet and I would guess that the domain (1d) should only be registered by the PDC emulator anyway. What I can't work out is why these errors started appearing about 3 months ago - we can't work out what, if any, change occured at that time.
We run a DNS-only environment (no WINS), 2k3 Native domain. We're looking to upgrade to a 2k8 Native domain (ie upgrading our DCs) but are wanting to get this niggling issue sorted first.
Any help would be much appreciated.
Regards,
Ben N.

Hi,
At some stage I've not been clear - no we most certainly don't have two IPs per server - the two IPs together above are the two domain controllers.
Here's the IPconfig:
DOMAIN CONTROLLER:
Windows IP Configuration
Host Name . . . . . . . . . . . . : svrdomain1
Primary Dns Suffix . . . . . . . : us.local
Node Type . . . . . . . . . . . . : Unknown
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No
DNS Suffix Search List. . . . . . : us.local
Ethernet adapter Local Area Connection 3:
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : HP Network Team #1
Physical Address. . . . . . . . . : 00-0B-CD-23-12-F9
DHCP Enabled. . . . . . . . . . . : No
IP Address. . . . . . . . . . . . : 10.0.0.10
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 10.0.0.1
DNS Servers . . . . . . . . . . . : 10.0.0.10
10.0.0.11
PROBLEMATIC SERVER:
Windows IP Configuration
Host Name . . . . . . . . . . . . : svrfile1
Primary Dns Suffix . . . . . . . : us.local
Node Type . . . . . . . . . . . . : Broadcast
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No
DNS Suffix Search List. . . . . . : us.local
Ethernet adapter Local Area Connection:
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : VMware Accelerated AMD PCNet Adapter
Physical Address. . . . . . . . . : 00-50-56-89-14-79
DHCP Enabled. . . . . . . . . . . : No
IP Address. . . . . . . . . . . . : 10.0.0.43
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 10.0.0.1
DNS Servers . . . . . . . . . . . : 10.0.0.10
10.0.0.11
Thanks,
Ben.

Windows could not start the Cluster Service on Local computer. For more information, review the System Event Log. If this is a non-Microsoft service, contact the service vendor, and refer to service-specific error code 2.

Dear Technet,
Windows could not start the Cluster Service on Local computer. For more information, review the System Event Log. If this is a non-Microsoft service, contact the service vendor, and refer to service-specific error code 2.
My cluster suddenly went disappear. and tried to restart the cluster service. When trying to restart service this above mention error comes up.
even i tried to remove the cluster through power-shell still couldn't happen because of cluster service not running.
Help me please.. thank you.
Regards
Shamil

Hi,
Could you confirm which account when you start the cluster service? The Cluster service is a service that requires a domain user account.
The server cluster Setup program changes the local security policy for this account by granting a set of user rights to the account. Additionally, this account is made a member
of the local Administrators group.
If one or more of these user rights are missing, the Cluster service may stop immediately during startup or later, depending on when the Cluster service requires the particular
user right.
Hope this helps.
We
are trying to better understand customer views on social support experience, so your participation in this
interview project would be greatly appreciated if you have time.
Thanks for helping make community forums a great place.

Error dbconsole 11g (system event log) , and emca ?

Hi to all
i work on database 11g r1 on windows 7 64 bit ultimate , and i am new on dba , when i want to start dbconsole service it appear this error :
Windows could not start the OracleDBConsoleOracl on Local Computer. For more information, review the System Event Log. If this is a non-Microsoft service, contact the system vendor, and refer to service-specific error code 1 . wha is the problem ?
another question plz
If I have written this command (emca -config dbcontrol db -repos recreate) .. What exactly will happen? and what is (emca log) ?
thank you very much

I am not clear about your 1st question but in last queation you are going to Drops the current Database Control management repository and then recreates a new one.
http://docs.oracle.com/cd/B28359_01/server.111/b28319/emca.htm

Reporting Services not automatically starting. System event log 7009, Application event: 18456

For the past month (since Oct 11,2012) reporting services (SSRS 2008R2) is not starting after the server is rebooted. The service is set to automatically start and starts manually without a problem. The system event log contains the following error:
Event ID 7009: A timeout was reached (30000 milliseconds) while waiting for the SQL Server Reporting Services (MSSQLSERVER) service to connect.
SQL logs :
The SQL logs has many "Event 18456 Login Failed, State 38" errors when the database engine starts. I assume clients conections are failing because the databases aren't online yet. None of these 18456 errors coorespond to the account reporting services
runs under.
The SQL logs indication Event 7009 occures before the "ReportingServer" database is online so im assuming there is a dependancy but I don't know how to avoid this.
This problem is occuring on a number of our servers running SSRS (if not all)
Any ideas?
Paul

Hi A141695,
For Event ID 7009, you can try to do the steps below to resolve it.
    1. Click Start, click Run, type regedit, and then click OK.
    2. Locate and then click the following registry subkey:
        HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control
    3. Right-click Control, point to New, and then click DWORD Value.
    4. In the New Value #1 box, type ServicesPipeTimeout, and then press ENTER.
    5. Right-click ServicesPipeTimeout, and then click Modify.
    6. Click Decimal, type the number of milliseconds that you want to wait until the service times out, and then click OK.
For example, to wait 60 seconds before the service times out, type 60000.
Quit Registry Editor, and then restart the computer. For more information about it, please see:
http://www.sqlservercentral.com/Forums/Topic850540-1550-1.aspx#bm851211
http://myitforum.com/myitforumwp/2012/08/22/configmgr-2012-sms_srs_reporting_point-component-failure/
If you have any questions, please feel free to ask.
Regards,
Charlie Liao
TechNet Subscriber Support
If you are TechNet Subscription user and have any feedback on our support quality, please send your feedback
here.

Mysterious repeat log entries in System events log

I tried unsuccessfully to share internet connection with 2 iMacs without router(That doesn't matter). But after this, my iMac (24" 2.8 GHz) not networked or on internet now shows this repeated log entries every minute:
com.apple.launchd[1] (com.apple.InternetSharing): Throttling respawn: Will start in 10 seconds
This message gets repeated every minute on System events log. Daily, Monthly maintenance was not done automatically earlier today on this iMac (usually it did without any problem) which was on all-night.
I checked with Disk Utility, repaired permissions. Although no problems in working, this continuous log writings disturbs me.
Thanks for any help & Happy New Year!
Best.

Thanks, V.K. Did that (was asked password). System log showed after restart:
com.apple.launchd[1] (com.apple.InternetSharing[152]): Exited with exit code: 1
com.apple.launchd[1] (com.apple.InternetSharing): Throttling respawn: Will start in 10 seconds
com.apple.launchd[1] (com.apple.InternetSharing153): Exited with exit code: 1
com.apple.launchd[1] (com.apple.InternetSharing): Throttling respawn: Will start in 10 seconds
Then it started again the same way as above - with each aditional line each time as shown above. Thanks for sticking with me on this. Hope you will offer other suggestions.
Best.

BT NetProtect Plus Error message in event log - mf...

Hi,
Anyonwe know why I am getting a warning in the system event log as follows
"Process **\MCSHIELD.EXE pid (2588) contains signed but untrusted code, but was allowed to perform a privileged operation with a McAfee driver."
Source: mfehidk
Event Id: 516
I am also getting the following error
"Unable to start a DCOM Server:{3A65891C-3794-43E5-89C8-20CCD19902CE}. The error: "740"
Happened while starting this command:
"C:\Program Files (x86)\McAfee\Supportability\MVT\MvtApp.exe" -Embedding"
Source: DistributedCOM
Event ID: 10000
Thanks
Mick

Hi,
You may check this:
XL Reporter Server Error Log - Please Help
Thanks,
Gordon

ZLM Event Log and System Event Log

I just created my base ZLM server using version 7.3 and updated a test SLES 10 server to use the 7.3 agent. The SLES server was running sp1 and running the 64-bit OS. I was able to successfully upgrade the server to sp2 but I noticed I don't get any entries in the event or system event log areas. This is under the Devices > Servers > Server name I could tell if the bundles installed successfully or the device was refreshed. I don't get anything now. Any thoughts or suggestions on how to fix this?

Oops. Sorry. Here is the output from rug ping
ZMD 7.3.0, Copyright (C) 2009 Novell, Inc.
Started at 4/15/2009 2:13:14 PM (uptime: 1 days, 23 hours, 33 minutes)
RSS size: 141440
Network Connected: Yes
Running on Mono 1.2.6
OS Target: SUSE Linux Enterprise Server 10.2 (x86_64)
Module Name | Description
-------------------+-------------------------------------------------
Image Agent Module | Novell ZENWorks Imaging Agent
Policy Manager | Manages policy enforcement on the device
Settings | Handles Settings refresh events.
TessModule | Tess Module
Inventory | Software and Hardware inventory module for Linux
NetworkManager | NetworkManager support
Package Management | Package Management module for Linux
RMModule | Remote Management module
ZENworks Server | SOAP methods used by a ZENworks server
Scheduled Actions | Scheduled Actions module for ZMD
XML-RPC interface | Export ZMD public interfaces over XML-RPC
log level is set to info
log-level | info | Logging level (off, fatal, error, warn, info, debug)

I just installed firefox as a broser. everytime I click on any website a pop up window named "java script application" and states "exc in ev handl:type error: oSAPLg. o root. log is not a function"

I just installed firefox as a broser. everytime I click a website the following pop up window opens. "exc in ev handl: type error: oSAPLg.o root. log is not a function. How do I correct this.

Please see solution in http://kb.mozillazine.org/Problematic_extensions
for "McAfee Site Advisor".
(Windows): For best results you should uninstall '''McAfee Site Advisor''' from Control Panel > add/change programs (Programs and Features). Reboot the system. Then Reinstall from http://www.siteadvisor.com/ and reboot the system. When installing refuse other suggested (crapware) applications.
<br><small>Please mark "Solved" one answer that will best help others with a similar problem -- hope this was it.</small>

My Ipad air continue to see error 4005, 4013, or 4014 when I try to restore . Although I did all the instructions in the help page , and I changed many computers and I still get same errors . Please help.

My Ipad air continue to see error 4005, 4013, or 4014 when I try to restore . Although I did all the instructions in the help page , and I changed many computers and I still get same errors . Please help.
Ipad air crushes and stuck in loop of apple logo then blue screen.

If you get the same errors on different computer and with different computers then contact Apple : iOS: Restore errors 4005, 4013, and 4014 :
If you continue to see error 4005, 4013, or 4014 when you restore your device, contact Apple for support.

My iMac does not connect to internet via wireless after I log in. I have to open network preferences and run the assistant everytime to make it work. Its a new system, updated to Mountain Lion,.

My iMac does not connect to internet via wireless after I log in. I have to open network preferences and run the assistant everytime to make it work. Its a new system, updated to Mountain Lion,.

Hi, this has worked for a few...
Make a New Location, Using network locations in Mac OS X ...
http://support.apple.com/kb/HT2712
10.7…
System Preferences>Network, top of window>Locations>Edit Locations, little plus icon, give it a name.
10.5.x/10.6.x/10.7.x instructions...
System Preferences>Network, click on the little gear at the bottom next to the + & - icons, (unlock lock first if locked), choose Set Service Order.
The interface that connects to the Internet should be dragged to the top of the list.
Instead of joining your Network from the list, click the WiFi icon at the top, and click join other network. Fill in everything as needed.
For 10.5/10.6, System Preferences>Network, unlock the lock if need be, highlight the Interface you use to connect to Internet, click on the advanced button, click on the DNS tab, click on the little plus icon, then add these numbers...
208.67.222.222
208.67.220.220
Click OK.
Also, turn off IPv6:
System Preferences » Network » AirPort » TCP/IP tab » Configure IPv6
Or whatever Interface you use.

Continuous "36888 Schannel Errors" in System Event Log when NOT connected to Internet

Similar Messages

Maybe you are looking for