Unable to translate Schannel errors recently

[jdickson289]

Windows Server 2019 Datacenter

Schannel errors appear like this now where before they were transcribed.

Log Name: System
Source: Schannel
Date: 12/11/2024 6:37:43 PM
Event ID: 36871
Task Category: None
Level: Error
Keywords:
User: S-1-5-18
Computer:
Description:
Unable to resolve description, see XML for more details.
Event Xml:



36871
0
2
0
0
0x8000000000000000

1568233


System




client
10013

[jschick04]

Is this resolving locally or with the databases?

[jdickson289]

Hi, Yes, it does resolve with Event Viewer locally just not in Event Log Expert. Best Regards, John Dickson Email: ***@***.******@***.***> Sr. Support Escalation Engineer Office: 469-775-2779 Microsoft Azure IaaS VM Technical Support Working Hours: Monday - Friday, 7:30 AM - 4:30 PM CST (12:30 - 21:30 UTC) Manager: Malik Elizee -email: ***@***.******@***.***> ***@***.*** From: Joseph Schick ***@***.***> Sent: Wednesday, December 11, 2024 5:12 PM To: microsoft/EventLogExpert ***@***.***> Cc: Author ***@***.***> Subject: Re: [microsoft/EventLogExpert] Unable to translate Schannel errors recently (Issue #397) Is this resolving locally or with the databases? - Reply to this email directly, view it on GitHub<#397 (comment)> or unsubscribe<https://github.com/notifications/unsubscribe-auth/AG4JD4GMNCNAWBVQJM35B2T2FDBDZBFKMF2HI4TJMJ2XIZLTSOBKK5TBNR2WLJDUOJ2WLJDOMFWWLO3UNBZGKYLEL5YGC4TUNFRWS4DBNZ2F6YLDORUXM2LUPGBKK5TBNR2WLJDUOJ2WLJDOMFWWLLTXMF2GG2C7MFRXI2LWNF2HTAVFOZQWY5LFUVUXG43VMWSG4YLNMWVXI2DSMVQWIX3UPFYGLLDTOVRGUZLDORPXI6LQMWWES43TOVSUG33NNVSW45FGORXXA2LDOOJIFJDUPFYGLKTSMVYG643JORXXE6NFOZQWY5LFVE2TKMBWGE3TSNJTQKSHI6LQMWSWS43TOVS2K5TBNR2WLKRSG4ZTGOJYGM4DCNFHORZGSZ3HMVZKMY3SMVQXIZI>. You are receiving this email because you authored the thread. Triage notifications on the go with GitHub Mobile for iOS<https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675> or Android<https://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub>.

[jschick04]

Let me clarify, which scenario are you performing...

1. Are you using databases under settings and viewing a saved log from 2019 on a non 2019 system.
2. Using databases under settings and viewing a saved log from 2019 on a 2019 system.
3. Using databases under settings and using "File > Open > Live Event Log > System".
4. No databases enabled under settings and using "File > Open > Live Event Log > System".
5. No databases enabled under settings and viewing a saved 2019 log from a non 2019 system.
6. No databases enabled under settings and viewing a saved 2019 log on a 2019 system.

I have only able to repro this when using multiple databases if the event is from an older system.
Example, loading a 2019 log and having databases for 2019 and 2022 enabled. This causes an issue because the event descriptions are different between versions and only the newer template is used. Because the event descriptions are different, the template parameters count does not match the events parameters count which is 1 reason we display "Unable to resolve description". If I disable the 2022 database and only use the 2019 database, then it resolves just fine.