Enable TLS 1.0 for lsass after KB5018419

Question

Hello,
Update KB5018419 turns off Transport Layer Security (TLS) 1.0 and 1.1 by default in Microsoft browsers and applications.

I've tried to Enable TLS 1.0 by default creating these entries in registry:
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\WinHttp]
"DefaultSecureProtocols"=dword:00000aa8

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Client]
"DisabledByDefault"=dword:00000000

This solution was working with KB5017379 (preview of KB5018419) See this question.

But with KB5018419, it's seems something is missing...
Application accessing to the TLS 1.0 server using winhttp is working. But BITS refuse to download anything from the server and raise an error code 0x80072f7d due to an error during the secured connection.

Enabling SChannel logs, in event viewer, I can see an log "The TLS protocol defined fatal alert code is 70" each time I try to resume my BITS job.
This error seems to be related to the protocol version (see here) and is linked to the process lsass.exe ( processid 632 given in the detail of this log).

What could be done to correct that?
Thanks!

Answer 1

Hi!
In fact, installing a new server, I realized that BITS service don't use SCHANNEL and so, this registry is not needed:
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Client]
"DisabledByDefault"=dword:00000000

However, DefaultSecureProtocols needs to be defined in two different registry for 64bits systems:

[HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\WinHttp]
"DefaultSecureProtocols"=dword:00000AA8

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\WinHttp]
"DefaultSecureProtocols"=dword:00000AA8

The second key was missing in my case.

Answer 2

Hello Everyone,

It is a known issue. The below link may be helpful.
https://learn.microsoft.com/en-us/windows/release-health/resolved-issues-windows-10-20h2#2924msgdesc

Please try to install the KB5018410 Out-of-band hotfix to resolve the issue.
https://support.microsoft.com/en-us/topic/october-17-2022-kb5020435-os-builds-19042-2132-19043-2132-and-19044-2132-out-of-band-243f34de-2f44-4015-a224-1b68a4132ca5

Best regard,