TLS handshake (36880) shows "Unknown" with strongest ciphers "0x1301" in windows server 2022

Question

We have observed an issue in our Windows Server 2022 environment while testing TLS handshakes.

The TLS handshake completes successfully, and the negotiated cipher suite is one of the TLS 1.3 cipher suites (for example, 0x1302). However, the Schannel event log reports the protocol version as "Unknown" instead of TLS 1.3.

The event details are shown below:

A TLS client handshake completed successfully. The negotiated cryptographic parameters are as follows.

Protocol version: Unknown

CipherSuite: 0x1302

Exchange strength: 0 bits

Context handle: 0x1bdf5351cd0

Since cipher suite 0x1302 corresponds to a TLS 1.3 cipher suite, I suspect that the connection is actually negotiating TLS 1.3. Could you please confirm whether this assumption is correct?

I also noticed that the same test performed on Windows Server 2025 negotiates the same TLS 1.3 cipher suite, but the Schannel event log correctly reports the protocol version as TLS 1.3 rather than Unknown.

My questions are:

Is the "Protocol version: Unknown" entry on Windows Server 2022 expected behavior for TLS 1.3?

Is this a known limitation or bug in Windows Server 2022 Schannel event logging?

Is there a Microsoft Knowledge Base (KB) update or hotfix that corrects this behavior?

Is there any registry setting or configuration change that enables Windows Server 2022 to correctly log TLS 1.3 instead of Unknown?

If this is expected behavior, what is the recommended Microsoft method to verify that a Windows Server 2022 connection has negotiated TLS 1.3?

Any clarification or guidance would be greatly appreciated.