Secure your Windows Servers' outbound connections.

Configure your Windows Server to use more secure ciphers and protocols for outbound HTTPS connections. If your Windows Server is kept at default TLS client settings, it can prefer to initiate TLS1.0 client connections instead of TLS1.3.

Why is TLS1.0 Insecure?

This matters because TLS1.0 can negotiate protocols that are considered weak cryptographically (SHA1 for example). Moreover, some remote services needed by your server might refuse such connections if they are enforcing safer connections.

How to Disable TLS1.0

You can run this from a user with sufficient permissions for registry edits:

# Create the registry keys
$registryPath = "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Client"

if (!(Test-Path $registryPath)) {
New-Item -Path $registryPath -Force
}

# Disable TLS 1.0 for outbound client connections
New-ItemProperty -Path $registryPath -Name "Enabled" -Value 0 -PropertyType DWORD -Force
New-ItemProperty -Path $registryPath -Name "DisabledByDefault" -Value 1 -PropertyType DWORD -Force

…from PowerShell to bring your Windows Server's outbound connections closer to modern day standards.

You might need to reboot your Windows server before these settings kick in.

Registry Modifications - Caution

Modifying the Windows Registry can cause serious, irreversible system errors or prevent the server from booting. These steps are provided for advanced users only and are performed at your own risk.

Recommended Precautions:

  • Backup: Export the registry keys or take a VM snapshot before editing.
  • Test: Validate changes in a staging environment before applying to production.