Odd issue here that I don't think is really causing any issues, but would like to figure out what's going on. I've got a DC and a TS that are on separate domains, no trust between the two, not a child/parent domain.
Domain controller - Win2k8R2, company.com domain, IP address 192.168.105.10
Terminal Server - Win2k8R2, production.com domain, IP addresses 192.168.0.8 (production network 1), 10.5.0.8 (production network 2), 192.168.105.142 (office/company.com domain network). Three separate NICs.
Every night at about 2:00 AM, the TS generates 6 errors:
1:58:26 AM - Event ID 56, TermDD, The Terminal Server security layer detected an error in the protocol stream and has disconnected the client: Client IP: 192.168.105.10
1:58:26 AM - Event ID 56 again, same as previous message
1:59:35 AM - Event ID 36888, Schannel, The following fatal alert was generated: 10. The internal error state is 1203.
1:59:42 AM - Event ID 36888 again, same as previous message
1:59:57 AM - Event ID 36888 again, same as previous message
1:59:57 AM - Event ID 56 again, same as first two messages
I'm less concerned with the errors themselves vs. how they're being generated. Nobody is using the DC to connect to the TS. What is the DC doing? Why/how is it trying to connect to a machine that's not even on the same domain? I can't find any correlating Event Log entries on the DC to explain what it's doing. There are no scheduled tasks, backups, etc. running or scheduled to be run at that time.
Thanks in advance.