Windows Server 2012 / 2012R2 VPN Accounting Issue

Question

Windows Server 2012 / 2012R2 VPN Accounting Issue

Greg MacD 1

We have 2 virtual windows servers that are being used as VPN servers for remote access. One is running Server 2012 and the other Server 2012 R2.

We do not know exactly when but the accounting feature in the remote access management has stopped working. This means we are unable to look at reports for connections to the VPN server. This functionality was working last year but now it is not on either server, it shows 0 bytes being used for the reports.

We are using “inbox accounting” which uses an windows internal database. We have tried disabling inboxing accounting and removing the existing windows internal database but re-enabling fails as below:

Anonymous

2021-01-20T06:13:35.693+00:00

First check event log to see if there are something related with accounting for us to troubleshooting.
Greg MacD 1 Reputation point

2021-01-21T10:06:06.633+00:00

Hi Candy,

It seems we have narrowed the issue down. We have disabled SSL 2.0, SSL 3.0 & TLS 1.0 recently on the server.

When we try to enable the reporting, the event viewer logs the following error:

"A fatal error occurred while creating an SSL client credential. The internal error state is 10013."

As soon as we re-enable TLS 1.0 the reporting works. We would like to keep TLS 1.0 disable though it appears the Windows Internal Database doesn't support TLS 1.2? Is this correct?

We tried also enabling FIPS in the group policy but this didn't work and isn't an ideal workaround either.

Thanks!

1 answer

Your answer

Anonymous

2021-01-20T06:13:35.693+00:00

First check event log to see if there are something related with accounting for us to troubleshooting.
Greg MacD 1 Reputation point

2021-01-21T10:06:06.633+00:00

Hi Candy,

It seems we have narrowed the issue down. We have disabled SSL 2.0, SSL 3.0 & TLS 1.0 recently on the server.

When we try to enable the reporting, the event viewer logs the following error:

"A fatal error occurred while creating an SSL client credential. The internal error state is 10013."

As soon as we re-enable TLS 1.0 the reporting works. We would like to keep TLS 1.0 disable though it appears the Windows Internal Database doesn't support TLS 1.2? Is this correct?

We tried also enabling FIPS in the group policy but this didn't work and isn't an ideal workaround either.

Thanks!

Answer 1

Hi @Greg MacD ,

Could you please post the PowerShell command or registry value for you to disable TLS 1.0?

I want to reproduce this phenomenon in my lab, but it seems the registry value doesn't work:

Best Regards,

Candy

--------------------------------------------------------------

If the Answer is helpful, please click "Accept Answer" and upvote it.

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Share via

Windows Server 2012 / 2012R2 VPN Accounting Issue

1 answer

Your answer