Schannel Event ID 36887 Fatal Error 48 - Microsoft please help!

[BridgeCC]

I am having the following issue on a SBS2011 server (2008R2 | DC | Exchange | Sharepoint disabled) and at another site on a 2008R2 standard server (DC). The SBS2011 has been driving me nuts for months (kicking 4 per minute) and everything I've tried from these forums has not worked. The 2008R2 server just started kicking the events - 2 identical errors every 15 seconds (8 per minute). I have seen posts for Server 2012 on this very issue as well.

ON BOTH SERVERS: I have verified the certificates (CA and 3rd party), IIS7 is running fine, checked the site bindings - ok, revoked and removed expired certificates - all cleaned up. Reset the machine password (NETDOM - OK).

ON THE SBS2011 SERVER I have additionally: Checked the certificates in Exchange/Hub Transports and along the way cleaned up a few other issues... all running clean now, except the 36887(48) errors.

This one needs to go away! Changing the event logging is not a solution to the problem. That is covering your eyes to it.

What is the root cause of the alert? and how do we fix it? Someone at Microsoft knows the answer here and there are a ton of us asking the same questions...

Please we need Microsoft to own this and kick down a KB/Windows Update fix for more detailed event tracking and come up with a solution to the problem. I know that it is a TLS/SSL issue, some posts say it is an exchange issue and some say it is caused by iPhones in particular connecting to my exchange server... if that was the case then why do they keep kicking every 15 seconds? I would be very surprised if the three iPhones, 3 iPads, and one android device pinging my exchange server were doing it every 15 seconds like clockwork. It is not the phones and tablets.

Also, why then am I seeing the same exact issue on a Windows Server 2008R2 with NO exchange server installed...???

Thank you in advance for any help in resolving this issue. Event logs from both machines below =>

Chris

SBS2011 Event log-

Log Name: System

Source: Schannel
Date: 2/28/2020 12:05:56 PM
Event ID: 36887
Task Category: None
Level: Error
Keywords:
User: SYSTEM
Computer: XXXXXXXXX.xxxxxxxx.local
Description:
The following fatal alert was received: 48.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Schannel" Guid="{1F678132-5938-4686-9FDC-C8FF68F15C85}" />
<EventID>36887</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8000000000000000</Keywords>
<TimeCreated SystemTime="2020-02-28T20:05:56.655981300Z" />
<EventRecordID>2077172</EventRecordID>
<Correlation />
<Execution ProcessID="532" ThreadID="12340" />
<Channel>System</Channel>
<Computer>xxxxxxxxx.xxxxxxxx.local</Computer>
<Security UserID="S-1-5-18" />
</System>
<EventData>
<Data Name="AlertDesc">48</Data>
</EventData>
</Event>


Server 2008R2 log-

Log Name: System
Source: Schannel
Date: 2/28/2020 12:42:48 PM
Event ID: 36887
Task Category: None
Level: Error
Keywords:
User: SYSTEM
Computer: XXXXXXXXX.XXXXXXXXXXX.NET
Description:
The following fatal alert was received: 48.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Schannel" Guid="{1F678132-5938-4686-9FDC-C8FF68F15C85}" />
<EventID>36887</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8000000000000000</Keywords>
<TimeCreated SystemTime="2020-02-28T20:42:48.587442200Z" />
<EventRecordID>14793879</EventRecordID>
<Correlation />
<Execution ProcessID="588" ThreadID="1880" />
<Channel>System</Channel>
<Computer>XXXXXXXXX.XXXXXXXXXXX.NET</Computer>
<Security UserID="S-1-5-18" />
</System>
<EventData>
<Data Name="AlertDesc">48</Data>
</EventData>
</Event>

Continue reading...