My log server was collecting loads of Schannel errors every day, so I decided to hunt them down.
The Cause
It turned out that a Group Policy Object controlling Internet Options was misconfigured to allow SSL 3.0 traffic.
The Fix
Disable SSL 3.0 as shown below, either with a GPO or on each machine. That stopped the log spam. For step-by-step instructions, see disabling SSL 3.0 with Group Policy or Internet Explorer, and for an earlier Schannel fix, see Schannel fatal alert 40 and 70.
