Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net. The EventId.Net for Splunk Add-on assumes that Splunk is collecting information from Windows servers and workstation via the Splunk Universal Forwarder.
|Maintenance: Recommended maintenance tasks for Windows servers|
The following fatal alert was received: 10.
|English: This information is only available to subscribers. An example of English, please!|
|Concepts to understand:|
What is Schannel?
This event may also be logged if one tries to initiate a HTTP connection to a HTTPS server, e.g. by requesting "http://you-server.com:443/" (this could also happen when the server is being probed or scanned for vulnerabilities).
The following is a list of SSL/TSL error messages and their code (matching the code recorded by this event):
The message may provide an additional clue as to what went wrong when this error was recorded. For example, Error code 10 (TLS1_ALERT_UNEXPECTED_MESSAGE) may indicate a lack of compatibility between the client app and the server.
This issue was seen on a Windows 2008 R2 server with Network Policy and Access Services (was IAS) running and is the RADIUS server for wireless authentication.
Data: The following fatal alert was received: 47.
The issue is that the NPS server cannot successfully authenticate the clients. Therefore, wireless client computers cannot connect to the wireless network successfully. This is caused by having too many entries in the trusted root certification list on the server. Every time a clients tries to make a connection this error will be logged in the System Event logs. See ME933430 for solutions to this issue.
As a general comment from a Microsoft engineer, This error message indicates the computer received an SSL fatal alert message from the server ( It is not a bug in the Schannel or the application that uses Schannel). Sometimes is caused by the installation of third party web browser (other than Internet Explorer).
Alert 47 - See EV100117, not a fix, but a discussion thread that may bring some additional clues in troubleshooting this problem.
Alert 48 - See EV100118 for some suggestions.
|Private comment: Subscribers only. See example of private comment|
|Search: Google - Bing - Microsoft - Yahoo - EventID.Net Queue (0) - More links...|
|Custom search for *****: Google - Bing - Microsoft - Yahoo|
Send comments or solutions
- Notify me when updated