Windows servers should be configured to use secure communication protocols.

Question

As far as I can tell, two of my Win11 VM's do not have this issue. The rest have this recommendation. All have TLS 1.2 and 1.3 enabled by default and use .NET 4.8.1. What else am I missing?

Answer 1

Hello @Tom Dastalfo,

Thank you using Q & A forum.

You should verify a few additional settings beyond just having TLS 1.2 and 1.3 enabled:

1. Disable Insecure Protocols: Make sure that older protocols such as SSL 2.0, SSL 3.0, TLS 1.0, and TLS 1.1 are disabled. This is crucial as these protocols are considered less secure and have known vulnerabilities that can be exploited. You can disable them by modifying the Windows Registry under the Schannel settings.
2. Application Configuration: Ensure that your applications are not explicitly setting a lower TLS version. For .NET applications, avoid using methods that specify the TLS version directly. Instead, let the operating system choose the best available version. If you must set a protocol, use SecurityProtocolType.SystemDefault to allow the OS to handle it appropriately.
3. Testing and Verification: After making the necessary changes, you can verify the active protocols using tools like SSL Labs or PowerShell commands to check which protocols are currently active. This will help ensure that your configuration is correct and that only secure protocols are in use.

---

If this answers your query, do click Accept Answer and Up-Vote for the same. And, if you have any further query do let us know.

Answer 2

If TLS 1.2 and TLS 1.3 are already available on the Windows 11 VMs, the usual missing piece is not enabling them, but explicitly disabling older protocols so the machine is restricted to secure protocols only.

Supported Windows versions can rely on Schannel defaults, and it is normal to have no SCHANNEL\Protocols registry entries at all. However, if a security recommendation expects only secure protocols, older protocols such as TLS 1.0 and TLS 1.1 may still need to be disabled explicitly.

What to check:

1. Verify whether older protocols are still allowed
   • Review HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols
   • Under that path, protocol subkeys such as TLS 1.2 and TLS 1.3 can contain Client and Server subkeys.
   • Enabled and DisabledByDefault DWORD values control protocol availability.
2. If the goal is to satisfy the secure communication recommendation
   • Disable insecure protocols: TLS 1.0 and TLS 1.1.
   • Keep TLS 1.2 enabled.
   • Keep TLS 1.3 enabled where supported.
3. Avoid forcing older TLS versions in .NET code
   • With .NET Framework 4.8.1, let the OS choose the protocol version.
   • Do not set ServicePointManager.SecurityProtocol to a specific older protocol.
   • Do not use SslProtocols.Default, because it forces SSL 3.0 / TLS 1.0.
   • If code must set a value, use SecurityProtocolType.SystemDefault or SslProtocols.SystemDefault/SslProtocols.None as applicable.
4. Reboot after protocol changes
   • TLS protocol configuration changes become active after restart.

Important note: Registry changes under Schannel affect system-wide TLS negotiation. Incorrect values can break legacy applications or integrations that still depend on TLS 1.0 or 1.1. Test application connectivity before broad rollout.

Why two Windows 11 VMs may already be compliant:

• They may already have older protocols disabled by policy or prior hardening.
• The others may still be using OS defaults that include secure support, but the recommendation is checking for explicit hardening rather than just availability of TLS 1.2/1.3.

---

References:

• Transport Layer Security (TLS) best practices with .NET Framework
• No registries under HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols - Microsoft Q&A
• How to fix Azure recomendation "Windows servers should be configured to use secure communication protocols" - Microsoft Q&A