Event ID 36888

Posted on 17/11/2015 by Migrated

KB ID 0000634

Problem

This was driving me nuts on my Windows 7 x64 Laptop.

Log Name: System
Source: Schannel
Event ID: 36888
Task Category: None
Level: Error
User: SYSTEM
Description:
The following fatal alert was generated: 10. The internal error state is 10.

I was getting a dozen of these an hour!

Solution

This error is caused (from what I can gather) by an error in certificate negotiation, your machine is trying to initiate communications with another machine/server using a certificate and TLS and the process is producing this error TLS1_ALERT_UNEXPECTED_MESSAGE (10).

1. If your browser is the cause of the problem, then simply open Internet Options > Advanced > Untick all the TLS options > Apply.

2. However this DID NOT WORK for me, so something is programmatically chatting from my laptop using TLS. The bottom line is, this problem is probably not even on your machine, so I’m simply going to disable SCHANNEL logging.

Note: If your Error does NOT say “The following fatal alert was generated: 10. The internal error state is 10“. then I would suggest NOT doing this.

3. In the search run box type regedit and navigate to the following key;

[box]
HKEY_LOCAL_MACHINE > System > CurrentControlSet > Control > SecurityProviders > SCHANNEL
[/box]

Change the EventLogging value from 1 to 0 (that’s a zero).

Error – Remove DirectAccess configuration settings from localhost before removing the Remote Access role.

Posted on 17/11/2015 by Migrated

KB ID 0000844

Problem

When attempting to remove the Direct Access role from a Windows 2012 Server, you see the following;

The validation process found problems on the server from which you want to remove features. The selected features cannot be removed from the selected server. Click OK to select different features.

DirectAccess is configured on {host-name}. Remove DirectAccess configuration settings form {host-name} before removing the emote Access role.

Or via PowerShell;

Remove-WindowsFeature : A prerequisite check for the RemoteAccess feature failed.

1. DirectAccess is configured on localhost. Remove DirectAccess configuration settings from localhost before removing the Remote Access role

Solution

1. This is because this server is still getting its settings for Direct Access via GPO, to get round the problem (quickly). Windows Key+R > Regedit {enter} > Navigate to;

[box]
HKEY_LOCAL_MACHINE > SYSTEM > CurrentControlSet > Services > RaMgmtSvc > Config[/box]

Locate and delete the ‘ServerGPO’ object.

2. Then retry to remove the Direct Access role.

3. DONT FORGET: If you are removing Direct access, there will still be group policy objects that will also need deleting.

Hide/Remove Users from the Windows Welcome/Logon Screen

Posted on 17/11/2015 by Migrated

KB ID 0000541

Problem

This was asked on EE the other day, and I’ve been asked it before, so I put it on my list of “Articles to write up”. Windows by default will display all “Enabled” accounts on the welcome screen. In most cases that’s fine, but the poster had installed SQL and all the service accounts were listed.

Solution

Option 1

Updated 09/08/12

Site visitor (Fehlmann Paolo ) Emailed in to suggest a better method of removing users from the logon screen. Essentially this removes ALL the local accounts from the login screen and only leaves the username and password option.

1. Here’s my test machine setup with multiple local accounts.

2. Log as a user with administrative access > Start > In the Search/Run box type regedit {enter} > Navigate to the following key;

[box]HKEY_LOCAL_MACHINE > SOFTWARE > Microsoft > Windows > CurrentVersion > Policies > System[/box]

Locate the ‘dontdisplaylastusername’ DWORD and change its value to 1 (number one).

3. Now you will get the following.

Option 2

1. Log on as a user with administrative rights and launch the registry editor.

2. Navigate to;

[box]HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsNTCurrentVersionWinlogon[/box]

Create a new “Key”.

3. Call it SpecialAccounts..

4. Right click the SpecialAccounts key, and create a new key.

5. Call this one UserList.

6. In the right hand window, right click and create a new DWORD (32 bit) value.

7. Create a value for each account you want to hide. By default its value will be 0 (zero) to stop hiding an account (in you require this in the future), you can delete the DWORD or change its value to 1 (one).

Note: You CAN create a value for Administrator and hide that in this way, however it’s considered “Good Practice” to have the local administrators account disabled, so that’s what I’m going to do.

8. Right click Computer and select Manage.

9. Navigate to “Local Users and Groups” > Users > Administrator > Right click >Properties.

10. Set “Account is disabled” > Apply > OK.

11. Now we have a much cleaner welcome screen.

PeteNetLive

Technology that 'Just Works'

Tag Archives: dword

Event ID 36888

Problem

Solution

Related Articles, References, Credits, or External Links

Error – Remove DirectAccess configuration settings from localhost before removing the Remote Access role.

Problem

Solution

Related Articles, References, Credits, or External Links