Windows Event ID 36887 – Schannel: TLS Connection Error or Certificate Validation Failure

Start by examining the complete event details to identify the specific failure reason and target server.

1. Open Event Viewer → Windows Logs → System
2. Filter for Event ID 36887 using the filter option
3. Double-click the most recent event to view full details
4. Note the Remote Server, Certificate Thumbprint, and Error Code
5. Use PowerShell to get detailed event information:

Get-WinEvent -FilterHashtable @{LogName='System'; Id=36887} -MaxEvents 5 | Format-List TimeCreated, Id, LevelDisplayName, Message

Record the specific error details for further investigation. The error code will guide you to the appropriate resolution method.

Check the target server's certificate status and validation chain to identify certificate-related issues.

1. Test the certificate using PowerShell:

# Replace with your target server
$serverName = "your-server.domain.com"
$port = 443

# Test TLS connection
$tcpClient = New-Object System.Net.Sockets.TcpClient
$tcpClient.Connect($serverName, $port)
$sslStream = New-Object System.Net.Security.SslStream($tcpClient.GetStream())
$sslStream.AuthenticateAsClient($serverName)
$certificate = $sslStream.RemoteCertificate
Write-Output "Certificate Subject: $($certificate.Subject)"
Write-Output "Valid From: $($certificate.GetEffectiveDateString())"
Write-Output "Valid To: $($certificate.GetExpirationDateString())"
$sslStream.Close()
$tcpClient.Close()

2. Check certificate store for missing intermediate certificates:

Get-ChildItem -Path Cert:\LocalMachine\CA | Where-Object {$_.Subject -like "*intermediate*"}

3. Verify root certificate authorities:

Get-ChildItem -Path Cert:\LocalMachine\Root | Format-Table Subject, Thumbprint, NotAfter

If certificates are expired or missing, contact your certificate authority or server administrator to resolve the certificate issues.

Adjust Windows TLS settings to ensure compatibility with the target server's security requirements.

1. Check current TLS protocol configuration:

# Check TLS registry settings
Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client" -ErrorAction SilentlyContinue
Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.3\Client" -ErrorAction SilentlyContinue

2. Enable TLS 1.2 if disabled (requires restart):

# Enable TLS 1.2 Client
New-Item -Path "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client" -Force
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client" -Name "Enabled" -Value 1 -Type DWORD
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client" -Name "DisabledByDefault" -Value 0 -Type DWORD

3. Check Group Policy for TLS restrictions:

gpresult /h c:\temp\gpresult.html

4. Test connection after changes:

Test-NetConnection -ComputerName "your-server.domain.com" -Port 443 -InformationLevel Detailed

Manually import required certificates or configure certificate trust to resolve validation failures.

1. Download the server's certificate chain:

# Download certificate from server
$serverName = "your-server.domain.com"
$port = 443
$webRequest = [Net.WebRequest]::Create("https://$serverName")
try {
    $webRequest.GetResponse()
} catch {
    $cert = $_.Exception.InnerException.Certificate
    $cert2 = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2($cert)
    Write-Output "Certificate: $($cert2.Subject)"
    Write-Output "Thumbprint: $($cert2.Thumbprint)"
    Write-Output "Issuer: $($cert2.Issuer)"
}

2. Import intermediate certificates if missing:

# Import certificate to Intermediate CA store
$certPath = "C:\temp\intermediate-cert.cer"
Import-Certificate -FilePath $certPath -CertStoreLocation Cert:\LocalMachine\CA

3. Add trusted root certificate if needed:

# Import to Trusted Root store (use with caution)
$rootCertPath = "C:\temp\root-cert.cer"
Import-Certificate -FilePath $rootCertPath -CertStoreLocation Cert:\LocalMachine\Root

4. Verify certificate installation:

Get-ChildItem -Path Cert:\LocalMachine\CA | Where-Object {$_.Thumbprint -eq "YOUR_CERT_THUMBPRINT"}

Enable comprehensive Schannel logging to capture detailed TLS handshake information for complex issues.

1. Enable Schannel event logging:

# Enable Schannel logging (requires restart)
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL" -Name "EventLogging" -Value 7 -Type DWORD

2. Configure advanced TLS logging:

# Enable TLS operational log
wevtutil set-log "Microsoft-Windows-Schannel/Operational" /enabled:true /retention:false /maxsize:102400000

3. Restart the system to apply logging changes
4. Reproduce the connection issue
5. Analyze detailed Schannel logs:

# Get detailed Schannel events
Get-WinEvent -LogName "Microsoft-Windows-Schannel/Operational" -MaxEvents 50 | Where-Object {$_.Id -in @(36874, 36875, 36887, 36888)} | Format-Table TimeCreated, Id, LevelDisplayName, Message -Wrap

6. Use network capture for protocol analysis:

# Start network trace (Windows 10/11/Server 2019+)
netsh trace start capture=yes provider=Microsoft-Windows-Schannel tracefile=c:\temp\schannel.etl
# Reproduce issue, then stop trace
netsh trace stop

7. Disable logging after troubleshooting:

Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL" -Name "EventLogging" -Value 1 -Type DWORD
wevtutil set-log "Microsoft-Windows-Schannel/Operational" /enabled:false