Share via

"Event Viewer" full of annoying "Schannel" errors.

Question

Thursday, January 2, 2020 12:53 PM

This is a problem that has plagued me as a Tech since Windows XP: "Schannel" errors in the Event Viewer" logs.

The only problem they ever seem to cause are startup delays (sometimes up to a minute) when Windows first loads. A minor annoyance, but I hate a log full of unexplainable errors I can't fix.

Right now, when I open the "Event Viewer" and look under "Windows Logs | System", it reports 17 errors during the startup process... each and everyone the source listed as "Schannel". The error messages are completely unhelpful ("Fatal error 70" & "Fatal error 80". ID of "36887".)

Online searches of these errors provide nothing helpful. There's nothing to tell me what app or process is causing the error so I can fix it. Simply being told "you have an error" without further details is insanely unhelpful.

So, does anyone know how to identify & fix these (exceedingly annoying) errors? TIA

All replies (7)

Friday, January 3, 2020 3:38 PM âś…Answered

Hello Mugsy_in_Houston,

What version of Windows are you running? On my Windows 10 (10.0.18363.535) system, the message text for event 36887 is "A fatal alert was received from the remote endpoint. The TLS protocol defined fatal alert code is %1."

This message text conveys a few important aspects of the event:

  • The problem is occurring on the remote system, and the remote system has sent an indication of that.
  • The "alert codes" are defined in the TLS RFCs.

40 is handshake_failure.

70 is protocol_version.

80 is internal_error.

If you look at the "Details" tab of the event, you might see the process ID of the process that logged the event:

Without additional evidence, it is not at all clear that these events would have any causal relationship with "start-up delays".

Gary

Thursday, January 2, 2020 2:58 PM

Kindly go through the following TechNet blog article:

SCHANNEL event logging

S.Sengupta,Microsoft MVP Windows and Devices for IT, Windows Insider MVP

Thursday, January 2, 2020 7:49 PM

Thanks for the reply.

I added the RegKey as instructed and rebooted.

I'm not quite sure what to do from there. The article mentions "Cipher Suite", which I do not have. And my error messages are the same as before (no added information.)

TIA

Friday, January 3, 2020 2:29 AM

Hi,

Could you please re-upload your screenshot because your screenshot cannot be displayed.

We are looking forward to your reply.

Have a nice day!

Bests,

Kiki

Please remember to mark the replies as answers if they help.
If you have feedback for TechNet Subscriber Support, contact [email protected].

Friday, January 3, 2020 1:35 PM

Could you please re-upload your screenshot because your screenshot cannot be displayed.

My apologies. I did not include a screenshot b/c I didn't think it would be much help.

Here is a quick screen cap. All of the Schannel errors are either 40, 70 or 80. All with an EventID of 36887.

TIA

Friday, January 3, 2020 4:18 PM

This message text conveys a few important aspects of the event:

  • The problem is occurring on the remote system, and the remote system has sent an indication of that.
  • The "alert codes" are defined in the TLS RFCs.

40 is handshake_failure.

70 is protocol_version.

80 is internal_error.

Thanks for the reply.

I think you identified the issue. I have a home network that I set up, but I rarely use the other computers and therefore are typically off.

It would make sense that the errors and any boot delays are due to my primary computer trying to find & connect to computers that are currently powered off.

I may try turning on my other two PC's prior to booting to see if the issue goes away. Thanks.

Monday, January 6, 2020 2:04 AM

Hi,

I am very glad to hear that this problem has been solved. Thank you for sharing. We are very grateful for your time and effort.

Bests,

Please remember to mark the replies as answers if they help.
If you have feedback for TechNet Subscriber Support, contact [email protected].