TLSCipherSuites Delete CSP Breaks Get-TlsCipherSuite Cmdlet

Brian Benavidez 201 Reputation points
2020-11-24T02:00:25.733+00:00

Attempting to use the Cryptography/TLSCipherSuites CSP to configure the SSL cipher suite order. The Add CSP works and I am able to confirm the allowed cipher suites using the Get-TlsCipherSuite cmdlet in PowerShell. However, when I use the Delete command, the Get-TlsCipherSuite cmdlet appears to stop working and I can no longer communicate with the MDM server. I'm using VMware's Workspace ONE UEM Cloud to send the commands.

Here is my Add command:

<Add>
<CmdID>8dea8bec-7164-46dc-9093-96c6de238f2c</CmdID>
<Item>
<Target>
<LocURI>./Device/Vendor/MSFT/Policy/Config/Cryptography/TLSCipherSuites</LocURI>
</Target>
<Meta>
<Format xmlns="syncml:metinf">chr</Format>
<Type>text/plain</Type>
</Meta>
<Data>TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384;TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384;TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384;TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384;TLS_DHE_RSA_WITH_AES_256_GCM_SHA384</Data>
</Item>
</Add>

And the Delete command:

<Delete>
<CmdID>8dea8bec-7164-46dc-9093-96c6de238f2c</CmdID>
<Item>
<Target>
<LocURI>./Device/Vendor/MSFT/Policy/Config/Cryptography/TLSCipherSuites</LocURI>
</Target>
<Meta>
<Format xmlns="syncml:metinf">chr</Format>
<Type>text/plain</Type>
</Meta>
<Data></Data>
</Item>
</Delete>

And the error I get when using the Get-TlsCipherSuite only AFTER I send the Delete command and restart (the cmdlet works fine before and after the Add):

get-tlsciphersuite : Exception from HRESULT: 0xD000000D
At line:1 char:12

  • $ciphers = get-tlsciphersuite
  • ~~~~~~~~~~~~~~~~~~
  • CategoryInfo : NotSpecified: (:) [Get-TlsCipherSuite], COMException
  • FullyQualifiedErrorId : System.Runtime.InteropServices.COMException,Microsoft.WindowsAuthenticationProtocols.Commands.GetTlsCipherSuiteCommand

The only way I've found to recover from this state is to do a device reset. Is the Delete command not supported? It's not very clear on the CSP page for TLSCipherSuites (https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-cryptography#cryptography-tlsciphersuites)

Not Monitored
Not Monitored
Tag not monitored by Microsoft.
39,612 questions
0 comments No comments
{count} votes

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.