The following fatal error was received: 46, event ID 36887

_{Thursday, December 4, 2014 12:27 AM}

Hi, we see the following error on our Domain controller occurring at 6am on a daily basis.

Log Name:      System
Source:        Schannel
Date:          4/12/2014 6:00:55 AM
Event ID:      36887
Task Category: None
Level:         Error
Keywords:     
User:          SYSTEM
Computer:      IDCDC02.domain.com.au
Description:
The following fatal alert was received: 46.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Schannel" Guid="{1F678132-5938-4686-9FDC-C8FF68F15C85}" />
    <EventID>36887</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2014-12-03T19:00:55.640033000Z" />
    <EventRecordID>7780</EventRecordID>
    <Correlation />
    <Execution ProcessID="496" ThreadID="1116" />
    <Channel>System</Channel>
    <Computer>IDCDC02.domain.com.au</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="AlertDesc">46</Data>
  </EventData>
</Event>

The server is running Windows Server 2008 R2, Enterprise and is a domain controller.

I have read on previous posts that this is due to an invalid certificate and more IIS related, only being a Windows domain controller, we don't have IIS on this machine currently.

Does anyone know what (else) it could be that's causing this?

Is 1F678132-5938-4686-9FDC-C8FF68F15C85 not reference to a Component Service? If so, which one would it be?

SB.

_{Thursday, December 4, 2014 3:20 AM ✅Answered}

Hi SB,

This alert message indicates this computer received a TLS or SSL fatal alert message from the server it was communicating or negotiating with.

The error indicates a state in the communication process, not necessarily a problem with the application. However, the cause could be how the application, such as a web browser, handled the communication.

"1F678132-5938-4686-9FDC-C8FF68F15C85" is a GUID. To find what does "1F678132-5938-4686-9FDC-C8FF68F15C85" mean, please seach it in the registry.

For detailed information about this event, please refer to the link below,

http://technet.microsoft.com/en-us/library/dn786445.aspx#BKMK_36887

Best Regards.

Steven Lee

TechNet Community Support