Share via

Scan domain forest for TLS 1.0

Jon Mercer 1,011 Reputation points
2021-11-15T18:50:59.097+00:00

Is there a way to scan the domain forest to find servers that are still using TLS 1.0?

This is mostly tied to this email.

You are receiving this message because our reporting indicates that your organization is still connecting using SMTP Auth client submission via smtp.office365.com with TLS1.0 or TLS1.1 to connect to Exchange Online.

We don't have many servers, but it doesn't look like from what I have been reading of an easy way, without 3rd party software, to find out if a server is still using TLS 1.0.

Why isn't there a tag for TLS?

Windows Server Security
Windows Server Security
Windows Server: A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.Security: The precautions taken to guard against crime, attack, sabotage, espionage, or another threat.
1,902 questions
0 comments

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Leon Laude 85,871 Reputation points
    2021-11-15T19:16:44.707+00:00

    Hi @Jon Mercer ,

    You could for example create a PowerShell script that checks the TLS registry entry mentioned in the following documentation:
    https://learn.microsoft.com/en-us/windows-server/security/tls/tls-registry-settings

    The run the script against all of your servers.

    You'll also find the default TLS & SSL settings on different Windows operating systems over here:
    https://learn.microsoft.com/en-us/windows/win32/secauthn/protocols-in-tls-ssl--schannel-ssp-

    Another easy way to check these settings is by using the free tool from Nartac:
    https://www.nartac.com/Products/IISCrypto/

    Here's more information regarding the email you've received:

    There is also a document from Microsoft which presents guidance on rapidly identifying and removing TLS 1.0 dependencies in software built on top of Microsoft operating systems, you'll find the guidance over here: Solving the TLS 1.0 Problem

    ----------

    If the reply was helpful please don't forget to upvote and/or accept as answer, thank you!

    Best regards,
    Leon

  2. Limitless Technology 39,796 Reputation points
    2021-11-16T08:48:08.65+00:00

    Hello JonMercer,

    Should not be difficult to achieve.

    You start with the powershell cmdlet Get-TLSCipherSuite | ft name,certificate,cipherlenght to prompt for the ciphers enabled on a machine, you will just need a csv with a server hostname list in your forest and run a FOREACH script against the list.

    --If the reply is helpful, please Upvote and Accept as answer--

    0 comments

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.