wslservice causes Schannel Event ID 36871 (error state 10013) and full system freeze after sleep/wake
- Dominant language
- C++
- Stars
- 33.7k
- Forks
- 1.8k
- Avg merge
- 3d 17h
- Merged PRs (30d)
- 116
Description
### Description
After waking my Windows 11 machine from sleep, the `wslservice.exe` process reappears automatically (even if it was previously stopped) and starts throwing **Schannel Event ID 36871** with **ErrorState 10013** in the System Event Log. Eventually, this leads to a **complete system freeze** (mouse/keyboard unresponsive) requiring a forced power-off.
I have found a **closed issue (#10630)** where the same Schannel error (36871/10013) was logged in the context of WSL crashes. However, that issue focuses on WSL failing to restart, while in my case the **entire operating system hangs**, which is far more severe and still occurs on the latest Windows 11 builds despite all recommended workarounds.
### Steps to Reproduce
1. Have WSL2 installed with any distribution (e.g., Ubuntu 22.04).
2. Use wsl --shutdown or stop the wslservice manually via Task Manager.
3. Put the computer to sleep (Sleep mode).
4. Wake the computer from sleep.
5. Observe that wslservice.exe has restarted automatically (visible in Task Manager).
6. After some time (minutes to hours), the system becomes completely unresponsive (mouse freezes, keyboard dead, only long-press power button works).
7. Check Event Viewer after forced reboot → multiple Schannel Event ID 36871 (error 10013) from wslservice are present.
### Expected Behavior
1. `wslservice ` should not restart unnecessarily after sleep if it was explicitly shut down.
2. Even if it runs, it should not cause TLS errors or system instability.
3. The OS must remain responsive regardless of WSL state.
### Actual Behavior
1. `wslservice ` reappears after sleep.
2. Schannel errors 36871/10013 are logged repeatedly.
3. Eventually, the entire Windows 11 UI freezes, forcing a hard reset.
### Environment
Windows build: W11, 25H2
WSL version: 2.6.3.0
Kernel version: 6.6.87.2-microsoft-standard-WSL2
Distro version: Docker Desktop (WSL2 backend) — no user distro installed
Other software: Docker Desktop (using WSL2 backend), T-FLEX DOCs (legacy .NET application).
### Attempted Workarounds (none resolved the issue)
1. Enabled TLS 1.0 and 1.1 via IIS Crypto (both Client and Server).
2. Added .NET Framework registry keys:
`SchUseStrongCrypto`=1, `SystemDefaultTlsVersions`=1 (for both 32/64-bit).
3. Verified `[Net.ServicePointManager]::SecurityProtocol` returns `SystemDefault`.
4. Limited WSL2 memory via `%UserProfile%\.wslconfig` (memory=4GB).
5. Stopped `wslservice` and used `wsl --shutdown` before sleep.
None of these prevent the error or the eventual system freeze.
### Related Issues
#10630 (closed) – contains the same Schannel 36871/10013 error in logs, but the primary issue was WSL not restarting; **my problem is more severe (full OS freeze)**.
### Diagnostic Logs
Latest Schannel error from Event Viewer (after wake):
```
-
-
36871
0
2
0
0
0x8000000000000000
XXXX
System
HOSTNAME
-
PPPP
wslservice
client
10013
```
### Additional Context
The problem persists on a clean installation of Windows 11 with all updates applied. It occurs even when no user interaction with WSL happens after wake – the service seems to start automatically and misbehave in the background.
Please investigate why `wslservice` reactivates after sleep and why its TLS errors can escalate to a full system freeze. If this is a duplicate of an existing internal bug, I would appreciate any pointer to a fix or workaround.
Contributor guide
Assessment
This issue has not been assessed yet.