IIS - Error 36887 (SSL Exceptions on localhost)

[Costas]

By going to My computer > Manage > Windows logs > System

sample :

- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
  
 
  <EventID>36887</EventID> 
  <Version>0</Version> 
  <Level>2</Level> 
  <Task>0</Task> 
  <Opcode>0</Opcode> 
  <Keywords>0x8000000000000000</Keywords> 
  <TimeCreated SystemTime="2020-06-24T11:11:19.605779900Z" /> 
  <EventRecordID>23263</EventRecordID> 
  <Correlation /> 
  <Execution ProcessID="456" ThreadID="8680" /> 
  <Channel>System</Channel> 
  <Computer>x</Computer> 
  <Security UserID="S-1-5-18" /> 
  </System>
- <EventData>
  <Data Name="AlertDesc">46</Data> 
  </EventData>
  </Event>

searching the registry for 1F678132-5938-4686-9FDC-C8FF68F15C85, you landed
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\eventlog\System\Schannel

disable the Schannel logging by setting EventLogging=0, add this to registry

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL]
"EventLogging"=dword:00000000

---

EventLogging possible values :
<code>Hex Decimal Description
0x0000 0 Do not log
0x0001 1 Log Error messages
0x0002 2 Log Warnings
0x0003 3 Log Error and Warning messages
0x0004 4 Log Informational and Success events
0x0005 5 Log Error, Informational and Success events
0x0006 6 Log Warnings, Informational and Success events
0x0007 7 Log Everything (Warnings, Errors, Informational and Success events</code>

ref
https://forums.iis.net/t/1168770.aspx

https://forums.ivanti.com/s/article/Error-SCHANNEL-1203-EventID-36888-Errors-Flooding-System-Event-Logs

Regarding Schannel, it’s one of the Security Support Providers. The Windows operating system implements the TLS/SSL protocols as a Security Support Provider SSP, a dynamic-link library (DLL) called Schannel that is supplied with the operating system.

https://social.technet.microsoft.com/Forums/windowsserver/fr-FR/4c5430f5-43f6-41b4-97d3-03cfb3efa70b/schannel-error-event-id-36888-is-there-a-way-to-identify-what-causes-schannel-to-log-error