*ERROR* Schannel - Event ID 36886

[Koldov]

I can't be sure if this has been triggered by something I've done since using Ping Castle, but since around the time I started working on the issues it identified the following error has started appearing on the server:

 

"No suitable default server credential exists on this system. This will prevent server applications that expect to make use of the system default credentials from accepting SSL connections. An example of such an application is the directory server. Applications that manage their own credentials, such as the internet information server, are not affected by this."

 

From the 'Details' view in Event Viewer I get ProcessID 728 (which today is the Kdc - Kerberos Key Distribution Center) and ThreadID 1212 (which is part of lsass).

 

I'm not seeing anything bad happening just yet, but any ideas how to sort this issue?

[Koldov]

I'm also getting an awful lot of these...

 

Event 36887 - Schannel

 

A fatal alert was received from the remote endpoint. The TLS protocol defined fatal alert code is 70.

 

Which has PID 728 and seems to tie up with lsass.exe - Local Security Authority Process.

 

Or in Services PID has the following listed:

 

Netlogon - Netlogon

SamSs - Security Accounts Manager

NTDS - Active Directory Domain Services

Kdc - Kerberos Key Distribution Center

Edited June 21, 2021 by Koldov

[free780]

Increasing the verbosity should give you more information.

Sometimes a Schannel error is just SChannel trying TLS 1.0 before trying TLS1.2

 

Enable Schannel event logging in Windows - Internet Information Services | Microsoft Docs