No registries under HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols

Sourav2044 110 Reputation points
2025-04-10T02:24:42.0166667+00:00

Hello Team,

I was currently checking what all TLS versions are available on one of our client's server hosting Windows Server 2019 Datacenter Operating System , 64 -bit and found that there are no entries under this

HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols

User's image

Is it a normal scenario?

Windows for business | Windows Server | User experience | Other
0 comments No comments

Answer accepted by question author
JIMT 75 Reputation points Microsoft Employee
2025-08-13T15:45:33.41+00:00

TLS 1.2 is ENABLED by default in EVERY OS starting with WINDOWS 2012. YOU DO NOT CREATE A REGISTRY SETTING FOR TLS 1.2
The same applies to TLS 1.3 which is officially fully supported on Win 11 and Server 2022.

The only reason to create registry content under SCHANNEL\Protocols is if you are enforcing the use of only TLS 1.2. Then you would DISABLE any other protocol (TLS 1.0 and 1.1).

This is done in the SCHANNEL registry location you specify in your query.

REFERENCES:
See the specific reference to SCHANNEL content in my blogs below.

https://techcommunity.microsoft.com/t5/ask-the-directory-services-team/speaking-in-ciphers-and-other-enigmatic-tongues-fresh-content/ba-p/4103506

https://techcommunity.microsoft.com/t5/ask-the-directory-services-team/more-speaking-in-ciphers-and-other-enigmatic-tongues-with-a/ba-p/4047491

More operating system supported protocols and ciphers:

https://learn.microsoft.com/en-us/windows/win32/secauthn/protocols-in-tls-ssl--schannel-ssp-

Was this answer helpful?

0 comments No comments

Answer accepted by question author
Marcin Policht 103.7K Reputation points MVP Volunteer Moderator
2025-04-10T03:27:27.8566667+00:00

Yep - AFAIK, this is expected. In short, you rely on defaults - which you can override by creating keys/entries. More at https://learn.microsoft.com/en-us/windows-server/security/tls/tls-registry-settings?tabs=diffie-hellman#tls-dtls-and-ssl-protocol-version-settings

SChannel SSP implements versions of the TLS, DTLS, and SSL protocols. Different Windows releases support different protocol versions.


If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin

Was this answer helpful?

0 comments No comments

0 additional answers

Sort by: Most helpful

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.