TLS handshake (36880) shows "Unknown" with strongest ciphers "0x1301" in windows server 2022

Question

TLS handshake (36880) shows "Unknown" with strongest ciphers "0x1301" in windows server 2022

Nazim Shaikh 20

We have observed an issue in our Windows Server 2022 environment while testing TLS handshakes.

The TLS handshake completes successfully, and the negotiated cipher suite is one of the TLS 1.3 cipher suites (for example, 0x1302). However, the Schannel event log reports the protocol version as "Unknown" instead of TLS 1.3.

The event details are shown below:

A TLS client handshake completed successfully. The negotiated cryptographic parameters are as follows.

Protocol version: Unknown

CipherSuite: 0x1302

Exchange strength: 0 bits

Context handle: 0x1bdf5351cd0

Since cipher suite 0x1302 corresponds to a TLS 1.3 cipher suite, I suspect that the connection is actually negotiating TLS 1.3. Could you please confirm whether this assumption is correct?

I also noticed that the same test performed on Windows Server 2025 negotiates the same TLS 1.3 cipher suite, but the Schannel event log correctly reports the protocol version as TLS 1.3 rather than Unknown.

My questions are:

Is the "Protocol version: Unknown" entry on Windows Server 2022 expected behavior for TLS 1.3?

Is this a known limitation or bug in Windows Server 2022 Schannel event logging?

Is there a Microsoft Knowledge Base (KB) update or hotfix that corrects this behavior?

Is there any registry setting or configuration change that enables Windows Server 2022 to correctly log TLS 1.3 instead of Unknown?

If this is expected behavior, what is the recommended Microsoft method to verify that a Windows Server 2022 connection has negotiated TLS 1.3?

Any clarification or guidance would be greatly appreciated.

Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

Answer accepted by question author

Allan Solomon Mejia 8,170

Hello @Nazim Shaikh

Yes, your interpretation is correct. Cipher suite 0x1302 is TLS_AES_256_GCM_SHA384, which is a TLS 1.3 cipher suite. Microsoft lists this cipher suite as TLS 1.3 for Windows Server 2022.

The Protocol version: Unknown shown by Schannel Event ID 36880 appears to be a Windows Server 2022 Schannel logging limitation rather than evidence that TLS 1.3 wasn't negotiated. The same behavior (Unknown, 0x1302, and exchange strength 0) has also been reported in earlier Microsoft Q&A discussions involving TLS 1.3 on Schannel.

I couldn't find a Microsoft-documented registry setting or specific KB/hotfix that changes the Server 2022 event output from Unknown to TLS 1.3. I therefore wouldn't recommend changing Schannel registry settings simply to correct the event's display value.

For verification, the most reliable approach is to capture the handshake using Wireshark or another network trace and inspect the ServerHello. For TLS 1.3, check the supported_versions extension for 0x0304 and confirm the negotiated cipher suite. The 0x1302 value you're already seeing is also strong evidence of TLS 1.3 because Microsoft documents that suite specifically for TLS 1.3.

So this looks primarily like a logging/display difference between Windows Server 2022 and Server 2025, not a TLS negotiation failure.

Please "Accept the Answer" if this information helped you. This will help us and others in the community as well.

Nazim Shaikh 20 Reputation points

2026-08-16T18:38:07.9+00:00

Thanks @Allan Solomon Mejia, this clarifies the TLS 1.3/cipher-suite part.

However, for our implementation and internal documentation, I would ideally need a Microsoft-confirmed reference for the specific Protocol version: Unknown behavior in Schannel Event ID 36880 on Windows Server 2022.

Specifically, I would like to understand:

Whether this is a known Schannel logging/display limitation or a bug in Windows Server 2022.

Whether Microsoft has provided, or plans to provide, any fix, cumulative update, hotfix, registry setting, or configuration change to make Event ID 36880 correctly report TLS 1.3.

So the specific Server 2022 Schannel Event 36880 Unknown behavior, its reason, and a possible Microsoft-supported fix/workaround still remain the key questions for us.
Allan Solomon Mejia 8,170 Reputation points

2026-08-16T21:42:33.17+00:00
Hi @Nazim Shaikh

Thanks for clarifying. I checked specifically for a Microsoft-published KB, hotfix, known-issue notice, or documented registry setting addressing Schannel Event ID 36880 showing Protocol version: Unknown for TLS 1.3 on Windows Server 2022.

At this time, I cannot find an official Microsoft document that classifies this specific Server 2022 behavior as a known bug or documents a fix/workaround. Therefore, I don't think it would be accurate to claim that Microsoft has officially confirmed it as a logging limitation.

There is, however, an older Microsoft Q&A case showing the same TLS 1.3 behavior: a successful Schannel handshake reports:

Protocol version: unknown

CipherSuite: 0x1302

Exchange strength: 0 bits

So the behavior has been observed independently on Microsoft platforms, but that Q&A discussion isn't equivalent to an official Microsoft product statement or KB.

Microsoft's Schannel documentation confirms that Event ID 36880 represents a successfully completed SSL/TLS handshake, and Microsoft's Schannel guidance describes 36880 as providing the negotiated cryptographic parameters.

For your requirement of a Microsoft-confirmed explanation of why Server 2022 displays Unknown, and whether Microsoft intends to correct it, I believe this now needs escalation through a Microsoft support case. Support can confirm whether this maps to an internal Windows/Schannel known issue and whether a servicing fix exists or is planned.

I would provide them with:

Windows Server 2022 build and latest CU installed

Event ID 36880 XML

TLS 1.3 cipher (0x1302)

Equivalent Server 2025 event showing TLS 1.3

Network trace demonstrating TLS 1.3 negotiation

That Server 2022 vs. Server 2025 comparison should give Microsoft a particularly clean reproduction case.

Microsoft Learn – Schannel Events | https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/dn786445(v=ws.11)?

So, for internal documentation, I would currently record this as “observed Server 2022 Schannel logging behavior; Microsoft confirmation pending”, rather than documenting it as a confirmed Microsoft bug or supported limitation.

Please don't forget to "Accept the Answer" if this information helped you. This will help us and others in the community as well.
Allan Solomon Mejia 8,170 Reputation points

2026-08-18T16:05:39.95+00:00

Hello @Nazim Shaikh

Please let me know if you need any further assistance. Otherwise, if the information provided resolved your issue, please click “Accept Answer” to help others who may encounter the same problem.

Thank you!

1 additional answer

Your answer

Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
Nazim Shaikh 20 Reputation points

2026-08-16T18:38:07.9+00:00

Thanks @Allan Solomon Mejia, this clarifies the TLS 1.3/cipher-suite part.

However, for our implementation and internal documentation, I would ideally need a Microsoft-confirmed reference for the specific Protocol version: Unknown behavior in Schannel Event ID 36880 on Windows Server 2022.

Specifically, I would like to understand:

Whether this is a known Schannel logging/display limitation or a bug in Windows Server 2022.

Whether Microsoft has provided, or plans to provide, any fix, cumulative update, hotfix, registry setting, or configuration change to make Event ID 36880 correctly report TLS 1.3.

So the specific Server 2022 Schannel Event 36880 Unknown behavior, its reason, and a possible Microsoft-supported fix/workaround still remain the key questions for us.
Allan Solomon Mejia 8,170 Reputation points

2026-08-18T16:05:39.95+00:00

Hello @Nazim Shaikh

Please let me know if you need any further assistance. Otherwise, if the information provided resolved your issue, please click “Accept Answer” to help others who may encounter the same problem.

Thank you!

Answer 1

Deleted

This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

Comments have been turned off. Learn more