How to enable Schannel event logging in IIS

Enable logging

Warning Serious problems might occur if you modify the registry incorrectly by using Registry Editor or by using another method. These problems might require that you reinstall your operating system. Microsoft cannot guarantee that these problems can be solved. Modify the registry at your own risk.

Start Registry Editor. To do this, click Start, click Run, type regedt32, and then click OK.

Locate the following key in the registry:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SecurityProviders\SCHANNEL

On the Edit menu, click Add Value, and then add the following registry value:
Value Name: EventLogging
Data Type: REG_DWORD

Note After you add this property, you must give it a value.
See the table in the "Logging options" section to obtain the appropriate value for the kind of events that you want to log.

Exit Registry Editor and restart the computer.
Logging does not take effect until after you restart the computer

Logging options

The default value for Schannel event logging is 0x0000 which means that no Schannel events are logged.
Additionally, you can log multiple events by specifying the hexadecimal value that equates to the logging options that you want. For example, to log error messages (0x0001) and warnings (0x0002), set the value to 0x0003.
Value Description
0x0000 Do not log
0x0001 Log error messages
0x0002 Log warnings
0x0004 Log informational and success events

Applies to

Microsoft Internet Information Services 8.0
Microsoft Internet Information Services 7.5
Microsoft Internet Information Services 7.0
Microsoft Internet Information Services 6.0
Microsoft Internet Information Services 5.1
Microsoft Internet Information Services 5.0
Microsoft Internet Information Server 4.0