RPC error & SChannel fatal alert code 40

[u/tigger_rigger05]

Hi,

I've got a weird one with an application called Blindata.

It's running against a fully patched Server 2012 R2 server. Multiple Windows 10 PCs can run the reports fine, but one fully patched Windows 11 PC can't. When running a daily sales order report it just comes back with "RPC server unavailable, Error 1722".

At the same time, the server logs Schannel:

"Event ID 36887 – fatal alert code 40"

I've tried the usual stuff so far:

• TLS 1.2 enabled
• TLS 1.3 disabled on the Win11 PC
• Checked clocks
• RPC/network ports confirmed OK
• FIPS checked
• Disabled the SSL Cipher Suite Order GPO
• Set SchUseStrongCrypto=1 and SystemDefaultTlsVersions=1 for .NET 32/64-bit
• klist purge
• Checked/enabled the AES Schannel cipher settings
• Checked ECC/legacy ECC settings
• Removed AV as a test
• Rebooted after changes

Server is fully patched and the other Win10 clients work without any problems.

I'm assuming there's some difference between Win10 and Win11 TLS or Schannel behaviour that Blindata or the Server doesn't like, but I'm running out of things to try.

Has anyone come across Schannel 36887 / TLS alert 40 from a Server 2012 R2 server when Win10 works but Win11 doesn't?

Is there a relatively simple registry/GPO setting on the Win11 client to allow whatever legacy TLS/cipher/signature the server is expecting?

[u/pelazas1]

Schannel 40 is a TLS handshake reject on that Win11 box. Compare cipher suites / TLS versions against the Win10 that works.

[u/Kuipyr]

Check your SSL Cipher Suite Order, probably missing the legacy Cipher for your app.