000017118 - Windows Eventing Collector  GENERAL ERROR  Error: 12030

Document created by RSA Customer Support Employee on Jun 14, 2016Last modified by RSA Customer Support Employee on Apr 22, 2017
Version 2Show Document
  • View in full screen mode

Article Content

Article Number000017118
IssueWindows Eventing Collector cannot collect Windows log from Windows Server 2008 computer
Error 12030
Cause3DES and RC4 are disabled on event source
Resolution

Windows Eventing Collector supports the following cipher suites:

  • TLS_RSA_WITH_RC4_128_MD5
  • TLS_RSA_WITH_RC4_128_SHA
  • TLS_RSA_WITH_3DES_EDE_CBC_SHA
  • TLS_RSA_WITH_DES_CBC_SHA
  • TLS_NTRU_NSS_WITH_AES_256_CBC_SHA
  • TLS_NTRU_NSS_WITH_3DES_EDE_CBC_SHA
  • TLS_RSA_EXPORT_WITH_RC4_40_MD5
  • TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5
  • TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA
  • TLS_DHE_DSS_WITH_DES_CBC_SHA
  • TLS_NTRU_NSS_WITH_AES_128_CBC_SHA

The error can occur if the following are disabled;  RC4 128/128 and Triple DES 168 cipher,  on a Windows 2008 event source.

For more information, please refer to http://support.microsoft.com/kb/245030 (the registry keys can apply to Windows 2008)

Users have encountered this same error if using a certificate with Microsoft Strong Cryptographic Provider.

In this case, the issue was resolved after changing the CSP to Microsoft RSA Schannel Cryptographic Provider.

Legacy Article IDa57114

Attachments

    Outcomes