When playing with SCM 3.0 and Windows 8 in my lab environment recently, I got an unpleasant surprise with my Direct Access connectivity in the Environment.
The Windows 8 client wouldn’t connect with IPHTTPS. When doing the usual troubleshooting with the netsh commands (netsh interface httpstunnel show interfaces) etc. I got the output “IPHTTPS interface not installed”.
That output usually shows up when you’re inside the corporate network.
When troubleshooting further I found out that the system event log were full with error 36874/Schannel as below.
The setting causing the problem was “System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing” under “Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options” .
The setting was Enabled by SCM and is by default Disabled.
After changing back the setting to Disabled I restored the IPHTTPS connectivity in my environment.
I am planning to follow this up as FIPS compliance is important for many organisations.
Hi,
Nice article, I’m experiencing same problem in my organization. we have UAG 2010 SP4 and clients are mix of Windows 7 and 8. in UAG server event viewer I observed there is tons of schannel 36874 & 36888 events generated.
Can you please let me know where we need to change the settings for “System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing” ? on UAG server or Client PC?
Thanks