Security Compliance

Schannel errors several times a minute on Patch Manager managed clients

How to resolve the Patch Manager issue where the default GPO does not trust the Eminentware CA certificate and returns Schannel errors every minute in the Windows security event log.

First published date

10/30/2018 10:56 PM

Last published date

10/30/2018 10:56 PM

Overview

You have successfully installed Patch Manager and deployed Patch Manager agents, but the default GPO does not trust the Eminentware CA cert and returns Schannel errors every minute in the Windows security event log.

Product section

Patch Manager

Cause

  • Error:  Schannel certificate Error 3688* 
  • The EminentWare CA and/Or EminentWare Agent cert is not in the Trusted Root CA
  • The Agent is no longer listed under the agents tab in the Patch Manager Server

Resolution

EminentWare CA And EminentWare Agent Certs are located in the Trusted Root CA Store on all Nodes with an installed Agent (not just the client components).

 

  1. Confirm that both certificates are valid and present in the Trusted Root CA Store
  2. Check the Agent bucket on the Patch Manager Server

  3. If the Agents are no longer listed please uninstall or reinstall the Agent if needed to recreate the certificate.