Windows Event ID 36874 – Schannel: TLS Connection Handshake Failure

Start by examining the complete event details to understand the specific failure reason and remote endpoint information.

1. Open Event Viewer by pressing Win + R, typing eventvwr.msc, and pressing Enter
2. Navigate to Windows Logs → System
3. Filter for Event ID 36874 by right-clicking the System log and selecting Filter Current Log
4. Enter 36874 in the Event IDs field and click OK
5. Double-click the most recent Event ID 36874 to view detailed information
6. Note the remote endpoint IP address, protocol version, and error description
7. Check the event timestamp to correlate with application or service connection attempts

Use PowerShell to extract multiple events for pattern analysis:

Get-WinEvent -FilterHashtable @{LogName='System'; Id=36874} -MaxEvents 50 | Select-Object TimeCreated, Message | Format-Table -Wrap

Verify the TLS protocol settings on the local system to ensure compatibility with remote endpoints.

1. Open Registry Editor as Administrator
2. Navigate to HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols
3. Check for subkeys like TLS 1.0, TLS 1.1, TLS 1.2, and TLS 1.3
4. Under each protocol version, examine the Client and Server subkeys
5. Verify the Enabled and DisabledByDefault DWORD values

Use PowerShell to check current TLS configuration:

Get-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\*\*' | Select-Object PSPath, Enabled, DisabledByDefault

To enable TLS 1.2 client connections if disabled:

New-Item -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client' -Force
New-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client' -Name 'Enabled' -Value 1 -PropertyType DWORD -Force
New-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client' -Name 'DisabledByDefault' -Value 0 -PropertyType DWORD -Force

Examine the certificate chain and trust store to identify certificate-related handshake failures.

1. Open Microsoft Management Console by running mmc.exe as Administrator
2. Add the Certificates snap-in for Computer account
3. Navigate to Certificates (Local Computer) → Trusted Root Certification Authorities → Certificates
4. Verify that required root certificates are present and not expired
5. Check Intermediate Certification Authorities for missing intermediate certificates

Use PowerShell to test certificate chain validation for a specific endpoint:

$endpoint = "example.com"
$port = 443
$tcpClient = New-Object System.Net.Sockets.TcpClient
$tcpClient.Connect($endpoint, $port)
$sslStream = New-Object System.Net.Security.SslStream($tcpClient.GetStream())
try {
    $sslStream.AuthenticateAsClient($endpoint)
    Write-Host "Certificate validation successful" -ForegroundColor Green
    $sslStream.RemoteCertificate | Format-List
} catch {
    Write-Host "Certificate validation failed: $($_.Exception.Message)" -ForegroundColor Red
} finally {
    $sslStream.Close()
    $tcpClient.Close()
}

To update the certificate store from Windows Update:

certlm.msc  # Open Certificate Manager
# Or use PowerShell to update root certificates
Invoke-Expression "certutil -generateSSTFromWU roots.sst"
Invoke-Expression "certutil -addstore -f root roots.sst"

Adjust cipher suite configuration to resolve compatibility issues with remote endpoints.

1. Open Group Policy Editor by running gpedit.msc
2. Navigate to Computer Configuration → Administrative Templates → Network → SSL Configuration Settings
3. Configure SSL Cipher Suite Order policy if available
4. Alternatively, use PowerShell to manage cipher suites directly

List current cipher suite order:

Get-TlsCipherSuite | Select-Object Name, Certificate, KeyExchange, Cipher, Hash | Format-Table -AutoSize

Enable specific cipher suites for compatibility:

# Enable TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 if disabled
Enable-TlsCipherSuite -Name "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384"

# Set cipher suite priority order
$cipherOrder = @(
    "TLS_AES_256_GCM_SHA384",
    "TLS_AES_128_GCM_SHA256",
    "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
    "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"
)

foreach ($cipher in $cipherOrder) {
    Enable-TlsCipherSuite -Name $cipher
}

Check registry for cipher suite configuration:

Get-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Cryptography\Configuration\SSL\00010002' -Name Functions -ErrorAction SilentlyContinue

Implement comprehensive logging and network analysis to diagnose complex handshake failures.

1. Enable detailed Schannel event logging in the registry
2. Configure network packet capture for TLS handshake analysis
3. Use Windows Performance Toolkit for advanced diagnostics

Enable verbose Schannel logging:

# Enable Schannel event logging
New-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL' -Name 'EventLogging' -Value 7 -PropertyType DWORD -Force

# Enable TLS handshake logging (Windows Server 2022/2025)
New-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL' -Name 'LogLevel' -Value 7 -PropertyType DWORD -Force

Capture network traffic for handshake analysis:

# Start network capture with netsh
netsh trace start capture=yes provider=Microsoft-Windows-TCPIP tracefile=C:\temp\tls_capture.etl

# Reproduce the TLS connection issue
# Stop capture
netsh trace stop

# Convert to pcap for Wireshark analysis
pktmon start --etw -f C:\temp\tls_packets.etl
# Reproduce issue
pktmon stop
pktmon etl2txt C:\temp\tls_packets.etl

Monitor Schannel events in real-time:

# Monitor Schannel events as they occur
Get-WinEvent -FilterHashtable @{LogName='System'; ProviderName='Schannel'} -MaxEvents 1 | Wait-Event

# Create custom event subscription
wevtutil cs schannel_monitor.xml
# Where schannel_monitor.xml contains subscription configuration

Analyze TLS handshake timing and performance:

# Use Performance Toolkit for detailed analysis
wpr -start GeneralProfile -start CPU -start Network
# Reproduce TLS issue
wpr -stop C:\temp\tls_analysis.etl

# Analyze with Windows Performance Analyzer
wpa C:\temp\tls_analysis.etl