A Site of Information and Ideas
My log server was collecting loads of Schannel errors every day, so I decided to hunt them down.
It turned out that a Group Policy Object controlling Internet Options was misconfigured to allow SSL 3.0 traffic.
Disable SSL 3.0 as shown below, either with a GPO or on each machine. That stopped the log spam. For step-by-step instructions, see disabling SSL 3.0 with Group Policy or Internet Explorer, and for an earlier Schannel fix, see Schannel fatal alert 40 and 70.
Windows was logging Schannel fatal alert 40 and fatal alert 70 errors. This turned out to be related to the System cryptography: Use FIPS compliant algorithms Group Policy setting, even though that policy was disabled.
Microsoft’s documentation says this GPO controls the registry key:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\FipsAlgorithmPolicyOn the affected machine, that value was still set to 1 (FIPS mode on), despite the policy being disabled.
I created a GPO at the workstation level with a registry preference (action: Update/Replace) on HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa that sets FipsAlgorithmPolicy to 0. After the next reboot, the machine stopped generating the Schannel errors.
Related: disabling SSL 3.0 in the SCHANNEL registry settings on IIS.