Exchange server - Event ID 36887 36888 36874

Question

Exchange server - Event ID 36887 36888 36874

超马 201

Hi,

I got the following errors in our Exchange server 2016. The TLS 1.2 1.1 1.0 protocols are enabled in Exchange server side. From the kb https://learn.microsoft.com/en-us/archive/blogs/silvana/schannel-errors-on-scom-agent，the issue could be related with SHA-512. However the certificates in our Exchange server is SHA-1. Any clues?

Accepted answer

0 additional answers

Your answer

Answer 1

Yuki Sun-MSFT 41,381 Moderator

Hi @67085432，

Is this a recently occurred issue after any changes were made in your environment?
Is everything works fine on both the users side and the Exchange server side?

Based on my research, if it is not causing any problems, this kind of Schannel event logging can be safely disabled by setting the value of the EventLogging key to 0:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SecurityProviders\SCHANNEL

- Value Name: EventLogging

Data Type: REG_DWORD
Value: 0

If any potentially relevant issue was noticed, you can post back with more information so that we can help do further research on this.

If an Answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

超马 201 Reputation points

2021-02-02T02:48:42.367+00:00

Hi YukiSun,

Several users in our company reported that they cannot receive the emails sent by their suppliers. The suppliers received the following NDRs. Yet we don't know if it's caused by the server errors. Because the mail issue doesn't recur recently.

----- Transcript of session follows -----
<yuqing.xu@X .com>... Deferred: 403 4.7.0 TLS handshake failed.
Message could not be delivered for 5 days
Message will be deleted from queue

Now we're trying to capture some traffics in Exchange server to analyze the TLS handshake problem.
Yuki Sun-MSFT 41,381 Reputation points Moderator

2021-02-03T09:04:09.83+00:00

Hi @67085432,

Yet we don't know if it's caused by the server errors. Because the mail issue doesn't recur recently.

If the TLS handshake mail issue doesn't occur any more but the events continue, it's hard to say that they are relevant.

Noticed that TLS1.2 was mentioned in Event 36874, from the perspective of Exchange server side, I'd recommend checking if your Exchange server 2016 has been made fully prepared for TLS 1.2 and TLS 1.2 is enabled properly and validated to be in use. Two links below for your reference:

Exchange Server TLS guidance, part 1: Getting Ready for TLS 1.2
Exchange Server TLS guidance Part 2: Enabling TLS 1.2 and Identifying Clients Not Using It
Yuki Sun-MSFT 41,381 Reputation points Moderator

2021-02-08T08:40:14.487+00:00

@67085432,
Checking in to see how things are going with this issue. Feel free to post back if there's anything else regarding this thread we can do to help.
超马 201 Reputation points

2021-03-01T06:12:09.177+00:00

Hi YukiSun,

Sorry for the late reply. My client currently is working on updating Exchange server to the latest CU to check if it helps. If there's any progress, I'll post back. Appreciate for your infos.

Share via

Exchange server - Event ID 36887 36888 36874

0 additional answers

Your answer