Disable TLS on servers

Glenn Maxwell 10,146 Reputation points
2022-09-28T21:47:04.047+00:00

Hi All

I have two questions.

i want to disable TLS 1.1, TLS 1.0 & Triple DES on my servers. i can see IISCrypto does but i dont to use third party software.

Are the below registries changes correct.

Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0
Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1

Server Folder-->New Item DWORD (32-bit) Value Underneath Server
Rename the Item DWORD (32-bit) Value to Enable(Hexadecimal value as 0)
Create New item DWORD (32-bit) 'DisabledByDefault' (Hexadecimal value as 0)

Please guide me how to disable Triple DES ciphers as i am not sure of the registry values.

  1. i would also want to disable these on Domain Controllers will this change cause any impact on applications.
  2. do i also need to disable RC2 and RC4 ciphers?
Windows Server 2019
Windows Server 2019
A Microsoft server operating system that supports enterprise-level management updated to data storage.
3,454 questions
Windows Server 2016
Windows Server 2016
A Microsoft server operating system that supports enterprise-level management updated to data storage.
2,370 questions
Windows Server
Windows Server
A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.
12,116 questions
Active Directory
Active Directory
A set of directory-based technologies included in Windows Server.
5,846 questions
Windows Server Security
Windows Server Security
Windows Server: A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.Security: The precautions taken to guard against crime, attack, sabotage, espionage, or another threat.
1,720 questions
0 comments
Accepted answer
  1. Dave Patrick 426.1K Reputation points MVP
    2022-09-28T21:51:33.997+00:00

    Read on here. Looks like DisabledByDefault should be non-zero
    https://learn.microsoft.com/en-us/windows-server/security/tls/tls-registry-settings#tls-dtls-and-ssl-protocol-version-settings

    --please don't forget to upvote and Accept as answer if the reply is helpful--

0 additional answers

Sort by: Most helpful
Most helpful Newest Oldest