Windows Eventing Collector GENERAL ERROR Error: 12030
2 years ago
Originally Published: 2012-01-23
Article Number
000047846
Issue
Windows Eventing Collector cannot collect Windows log from Windows Server 2008 computer
Error 12030
Cause
3DES and RC4 are disabled on event source
Resolution

Windows Eventing Collector supports the following cipher suites:

  • TLS_RSA_WITH_RC4_128_MD5
  • TLS_RSA_WITH_RC4_128_SHA
  • TLS_RSA_WITH_3DES_EDE_CBC_SHA
  • TLS_RSA_WITH_DES_CBC_SHA
  • TLS_NTRU_NSS_WITH_AES_256_CBC_SHA
  • TLS_NTRU_NSS_WITH_3DES_EDE_CBC_SHA
  • TLS_RSA_EXPORT_WITH_RC4_40_MD5
  • TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5
  • TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA
  • TLS_DHE_DSS_WITH_DES_CBC_SHA
  • TLS_NTRU_NSS_WITH_AES_128_CBC_SHA

The error can occur if the following are disabled;  RC4 128/128 and Triple DES 168 cipher,  on a Windows 2008 event source.

For more information, please refer to http://support.microsoft.com/kb/245030 (the registry keys can apply to Windows 2008)

Users have encountered this same error if using a certificate with Microsoft Strong Cryptographic Provider.

In this case, the issue was resolved after changing the CSP to Microsoft RSA Schannel Cryptographic Provider.