It’s common knowledge that TLS is preferred over SSL because it provides better security, and because an industry-wide push to stop using SSL, use HTTPS exclusively (instead of HTTP), and increase security overall has been underway for a while. But it’s also important to use the latest version of TLS. Fortunately Windows Server 2012 R2 supports all three current versions of TLS, 1.0, 1.1 and 1.2. But, what if your server requires the disabling of lower versions, like 1.0 or even 1.1? Sure, there are various resources on the Internet from .reg files to both paid and free utilities, but since I often work in environments restricting the use of such methods, and since I like to use the simplest native method possible I have a set of commands I run in PowerShell to both disable TLS 1.0 and 1.1, and explicitly create keys and enable TLS 1.2 (which aren’t already in the registry for some reason).
Note: although this was written specifically for Server 2012 R2 these commands work on Server 2008 R2 as well.
After installing the latest version of PowerShell on new servers one of the next things I do is run the set of commands below. First though, we’ll take a look at the current security (SCHANNEL) protocols on a new 2012 R2 server with:
Get-ChildItem -Path HKLM:SystemCurrentControlSetControlSecurityProvidersSCHANNELProtocols -Recurse
 |
| View SCHANNEL Registry settings in PowerShell on Server 2012 R2. |
Here is the set of commands I run to disable TLS 1.0 and 1.1 and explicitly enable TLS 1.2 on Windows Server 2012 R2:
#2012 R2 - Disable TLS 1.0, 1.1, enable 1.2
$TLSProto = "TLS 1.0" New-Item
"HKLM:SystemCurrentControlSetControlSecurityProvidersSCHANNELPROTOCOLS" –Name "TLS 1.0" New-Item
"HKLM:SystemCurrentControlSetControlSecurityProvidersSCHANNELPROTOCOLS$TLSProto" –Name CLIENT New-Item
"HKLM:SystemCurrentControlSetControlSecurityProvidersSCHANNELPROTOCOLS$TLSProto" –Name SERVER New-ItemProperty
"HKLM:SystemCurrentControlSetControlSecurityProvidersSCHANNELPROTOCOLS$TLSProtoCLIENT" –Name Enabled –Value 0 –Type DWORD New-ItemProperty
"HKLM:SystemCurrentControlSetControlSecurityProvidersSCHANNELPROTOCOLS$TLSProtoSERVER" –Name Enabled –Value 0 –Type DWORD
$TLSProto = "TLS 1.1" New-Item
"HKLM:SystemCurrentControlSetControlSecurityProvidersSCHANNELPROTOCOLS" –Name "$TLSProto" New-Item
"HKLM:SystemCurrentControlSetControlSecurityProvidersSCHANNELPROTOCOLS$TLSProto" –Name CLIENT New-Item
"HKLM:SystemCurrentControlSetControlSecurityProvidersSCHANNELPROTOCOLS$TLSProto" –Name SERVER New-ItemProperty
"HKLM:SystemCurrentControlSetControlSecurityProvidersSCHANNELPROTOCOLS$TLSProtoCLIENT" –Name Enabled –Value 0 –Type DWORD New-ItemProperty
"HKLM:SystemCurrentControlSetControlSecurityProvidersSCHANNELPROTOCOLS$TLSProtoCLIENT" –Name DisabledByDefault –Value 1 –Type DWORD New-ItemProperty
"HKLM:SystemCurrentControlSetControlSecurityProvidersSCHANNELPROTOCOLS$TLSProtoSERVER" –Name Enabled –Value 0 –Type DWORD New-ItemProperty
"HKLM:SystemCurrentControlSetControlSecurityProvidersSCHANNELPROTOCOLS$TLSProtoSERVER" –Name DisabledByDefault –Value 1 –Type DWORD
$TLSProto = "TLS 1.2" New-Item
"HKLM:SystemCurrentControlSetControlSecurityProvidersSCHANNELPROTOCOLS" –Name "$TLSProto" New-Item
"HKLM:SystemCurrentControlSetControlSecurityProvidersSCHANNELPROTOCOLS$TLSProto" –Name CLIENT New-Item
"HKLM:SystemCurrentControlSetControlSecurityProvidersSCHANNELPROTOCOLS$TLSProto" –Name SERVER New-ItemProperty
"HKLM:SystemCurrentControlSetControlSecurityProvidersSCHANNELPROTOCOLS$TLSProtoCLIENT" –Name Enabled –Value 1 –Type DWORD New-ItemProperty
"HKLM:SystemCurrentControlSetControlSecurityProvidersSCHANNELPROTOCOLS$TLSProtoCLIENT" –Name DisabledByDefault –Value 0 –Type DWORD New-ItemProperty
"HKLM:SystemCurrentControlSetControlSecurityProvidersSCHANNELPROTOCOLS$TLSProtoSERVER" –Name Enabled –Value 1 –Type DWORD New-ItemProperty
"HKLM:SystemCurrentControlSetControlSecurityProvidersSCHANNELPROTOCOLS$TLSProtoSERVER" –Name DisabledByDefault –Value 0 –Type DWORD
