sglee
asked on
Fatal Alert Event ID 36888
Hi,
I am getting "The following fatal alert was generated: 10. The internal error state is 1203" error on SBS2011. Is this something I need to address or I can ignore?
Thanks.
Log Name: System
Source: Schannel
Date: 4/18/2014 11:59:25 AM
Event ID: 36888
Task Category: None
Level: Error
Keywords:
User: SYSTEM
Computer: DC1.DomainName.local
Description:
The following fatal alert was generated: 10. The internal error state is 1203.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Schannel" Guid="{1F678132-5938-4686-
<EventID>36888</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x80000000000000
<TimeCreated SystemTime="2014-04-18T15:
<EventRecordID>466454</Eve
<Correlation />
<Execution ProcessID="560" ThreadID="1400" />
<Channel>System</Channel>
<Computer>DC1.DomainName.l
<Security UserID="S-1-5-18" />
</System>
<EventData>
<Data Name="AlertDesc">10</Data>
<Data Name="ErrorState">1203</Da
</EventData>
</Event>
I am getting "The following fatal alert was generated: 10. The internal error state is 1203" error on SBS2011. Is this something I need to address or I can ignore?
Thanks.
Log Name: System
Source: Schannel
Date: 4/18/2014 11:59:25 AM
Event ID: 36888
Task Category: None
Level: Error
Keywords:
User: SYSTEM
Computer: DC1.DomainName.local
Description:
The following fatal alert was generated: 10. The internal error state is 1203.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Schannel" Guid="{1F678132-5938-4686-
<EventID>36888</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x80000000000000
<TimeCreated SystemTime="2014-04-18T15:
<EventRecordID>466454</Eve
<Correlation />
<Execution ProcessID="560" ThreadID="1400" />
<Channel>System</Channel>
<Computer>DC1.DomainName.l
<Security UserID="S-1-5-18" />
</System>
<EventData>
<Data Name="AlertDesc">10</Data>
<Data Name="ErrorState">1203</Da
</EventData>
</Event>
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
have you installed anything new on the server? like an antivirus program?
also are you running sharePoint on that server?
Please advise
Thank you
also are you running sharePoint on that server?
Please advise
Thank you
ASKER
have you installed anything new on the server? like an antivirus program? ---> everything was fine until I installed Symantec EndPoint Protection 12.1. Users could not connect to the server/SBS2011 via mapped Drives ... etc.
So I completely uninstalled EndPoint protection from SBS2011 now.
also are you running sharePoint on that server? ---> it is a default SBS2011 install. I don't know what sharepoint is or does.
So I completely uninstalled EndPoint protection from SBS2011 now.
also are you running sharePoint on that server? ---> it is a default SBS2011 install. I don't know what sharepoint is or does.
SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
@wsawalhi
I followed up on the link above and ran the command in SharePoint Mgmt Shell, but it DID NOT return True. Actually nothing was returned.
(get-spserver $env:computername).NeedsUp
I followed up on the link above and ran the command in SharePoint Mgmt Shell, but it DID NOT return True. Actually nothing was returned.
(get-spserver $env:computername).NeedsUp
how often is this error message showing in the event viewer?
ASKER
Since March 2014, it happened twice, both today at 11:59:15 AM and 11:59:25AM.
SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
Thanks.
ASKER
All users on the network connects to Terminal Server (W2008) using Remote Desktop Connection and run Office Apps (Word/Excel/Outlook).
There are some users that directly opens files from their desktop computer from mapped drives (off SBS2011) because some apps could not be installed on the Terminal Server environment.
Outside users connect to the Terminal Server as well using Remote Desktop.
No user knows how to connect to RWW and most computers on the network has Windows 7 or 8 HOME version, so can't accept connections.
Having said that, if I assume that no internal user tried http instead of https for OWA, could it be some hackers trying to poke around my SBS2011 network?