Schannel Errors 36874 and 36888

Question

Greetings,
The scenario is the following: 1 Windows Server 2008 R2 SP1 (patched up to date).
There are two errors that shows every 10 seconds:
Log Name:      System
Source:        Schannel
Date:          19/07/2012 14:59:58
Event ID:      36874
Task Category: None
Level:         Error
Keywords:      
User:          SYSTEM
Computer:      Server.Mydomain.com
Description:
An SSL 3.0 connection request was received from a remote client application, but none of the cipher suites supported by the client application are supported by the server. The SSL connection request has failed.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Schannel" Guid="{1F678132-5938-4686-9FDC-C8FF68F15C85}" />
    <EventID>36874</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2012-07-19T19:59:58.511146300Z" />
    <EventRecordID>5908</EventRecordID>
    <Correlation />
    <Execution ProcessID="484" ThreadID="524" />
    <Channel>System</Channel>
    <Computer>Server.Mydomain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="Protocol">SSL 3.0</Data>
  </EventData>
</Event>
Log Name:      System
Source:        Schannel
Date:          19/07/2012 14:59:58
Event ID:      36888
Task Category: None
Level:         Error
Keywords:      
User:          SYSTEM
Computer:      Server.Mydomain.com
Description:
The following fatal alert was generated: 40. The internal error state is 107.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Schannel" Guid="{1F678132-5938-4686-9FDC-C8FF68F15C85}" />
    <EventID>36888</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2012-07-19T19:59:58.511146300Z" />
    <EventRecordID>5909</EventRecordID>
    <Correlation />
    <Execution ProcessID="484" ThreadID="524" />
    <Channel>System</Channel>
    <Computer>Server.Mydomain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="AlertDesc">40</Data>
    <Data Name="ErrorState">107</Data>
  </EventData>
</Event>
Note: This server has IIS installed (requirement for web console of System Center Operations Manager 2012)
The questions are:
Is this behavior normal?
if no
How to fix this problem?
Thanks in advance!

Answer 1

Hi,
This error can be received due to an incompatible browser problem and SSL 3.0 connection request cannot be handled.
As discussed, we can modify that registry key to disable the additional secure channel event logging if every works fine.
Also we can check the thread below. It mentioned another scenario in which the "The following fatal alert was generated: 40. The internal error state is 107." error could be received:
Why does Window's SSL Cipher-Suite get restricted under certain SSL certificates?
http://serverfault.com/questions/166750/why-does-windows-ssl-cipher-suite-get-restricted-under-certain-ssl-certificates
(Note: Since the site is not hosted by Microsoft, the link may change without notice. Microsoft does not guarantee the accuracy of this information.)
Regards
Kevin