Windows 2012 Event 36887

The Server Received a record with an incorrect MAC.

It's possible that the client does not support the TLS version of the Server.
When the client attempts to negotiate a TLS 1.2 connection but the server supports only TLS 1.0 or 1.1, it will not send client certificates to the server.
The only solution I can suggest if this is the case is to reduce the client TLS version to match the server capabilities.

http://blogs.msdn.com/b/kaushal/archive/2012/10/06/ssl-tls-alert-protocol-amp-the-alert-codes.aspx

Leon


"The only solution I can suggest if this is the case is to reduce the client TLS version to match the server capabilities."


How do i do that this is new to me.

Or should I turn this off
https://support.microsoft.com/en-us/kb/260729

Depends what you are running on the server.
if it's IIS (you should be on 8.5), TLS1.0-1.2 support is enabled out of the box.
If it's RDP, you need to update the client RDP client.
If it's something else, like SMTP calls, FTP, SQL Server et cetera, you'll need to have a look at the TLS configurations available within the application.

Cheers

Leon

Leon

Yes IIS 8.5 will be web server

No sql that runs on my windows 200& server

No rdp used I use vnc to control remotely

Maybe rdp is installed will check

On the road now

Cheers

Tom

Ok

No rdp installed

Now getting same error with a 47 that's the second type

I turned of logging see if that stops the message

Thoughts

Leon

Only IE installed I limit the third party programs on my Servers to a minimum.

Will look at the trusted certs  what do you mean by can be too many entries?

What is the limits?

Hi Tom,

I am not 100% certain what the maximum is.
Due to changes in Server 2012, you will find a mixture of CAs in the trusted certificate store.

The Windows error log will contain this:
When asking for client authentication, this server sends a list of trusted certificate authorities to the client.
The client uses this list to choose a client certificate that is trusted by the server.
Occasionally, the server trusts so many certificate authorities that the list has grown too long. This list has thus been truncated.
The administrator of this machine should review the certificate authorities trusted for client authentication and remove those that do not really need to be trusted.

hth

Leon

Leon

will check this out over the weekend when on site again.


Thanks

Will post results

Leon

After turning off the logging have not seen this error.

Thanks