How to disable SSL 2.0, SSL 3.0, TLS 1.0 and TLS 1.1 in Windows 10

This video shows you how to disable the support for older weaker SSL protocols, such as SSL 2.0, SSL 3.0, TLS 1.0 and TLS 1.1.

These weak SSL protocols which are regularly picked up on security audits as well as Cyber Essentials assessments, which can be easily remediated.

Go into regedit, then go to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\

From there create a new Key for 'SSL 2.0', 'SSL 3.0', 'TLS 1.0' and 'TLS 1.1'

for instance: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0

Then, create a client and server key inside the protocol you are disabling

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Client

Then create a DWORD value called 'Enabled' with the default value of 0. If the value has 1, then this enables the weaker cipher.

Connect with InfoSec Governance at:

[Good-Enuff-Garage]

this was the best instructional video I have seen in my life, more videos like this one on EVERYTHING please

[saikrishnavinjamuri]

Thank you so much for the video.. watching this I disabled TLs old versions in a server.. thanks again

[Stan-mhbf]

Nice video mate! How does it correspond to settings that can be found in Control Panel? Specifically I mean under Control Panel\Network and Internet -> Internet Options -> Advanced tab-> Security -> Use SSL 3.0/Use TLS 1.0/Use TLS 1.1

[jay]

Hello,
If I Disable SSL 3.0 with only Server entry (without Client). Then what happens???

[rcooper]

Question - why are we adding the SSL components? Don't we want to use SSL 2.0 and 3.0?

[goolark]

Thank you.
Выебла мозг эта десятая винда. Убрали управлеие протоколом SSL 2.0 из оснастки и что хояешь то и делай.
Спасибо тебе добрый человек.
сделал файл реестра теппрь просто импортирую его на проблемных машинах.

[infosec]

Congratulations for the explanation! Example: I have an application on IIS, I scanned it and it presented me with weak ciphers using vulnerable protocols such as SSLv2, SSLv3, TLS 1.0 and TLS 1.2. I managed to disable the protocols, will my application after disabling the protocols work normally?

[Ayrzens]

It always says cannot connect to this page (Youtube) on my pc cuz it said it has an expired /unsafe TLS settings can u help

[peternguyen]

if we disable the SSL we ensure the web application hosted in the server will be accessed only via http (no https ). am i right to say that. right now i am struggling to config my web application on IIS that server only the http. thanks

[Serpentar]

Hello, thx for this video.Quick question-does this applies to rdp connection as well?

[jaybigboy]

Can you show us how to do this in a group policy for multiple computers? Thank you

[slymaneem]

what is the difference between server and client in the keyword. I adjustted like this video in my server. But Remote server couldnt connect to my webservice. what should I do ?

[infosec]

I saw some comments about FTP in the video and if I had an ftp on iis and disabled vulnerable protocols, would that impact FTP functionality? Would I have to make any more changes to the settings?

[Screew]

Hello, thx for the video. I created the Enabled and DisabledByDefault DWORD and set the Enabled -> 0, DisabledByDefault->1 but, dont't work. If i check the Control Panel\Internet Option\Advanced, i see that the TLS 1.0 is active.

[vinodkp]

Hi, I have disabled TLS 1.0 but still showing vulnerability in Nessus scan report

[ultraweapon]

I have found a website, .in which TLS 1.0 enabled, .Is this a Vulnerability? Can I report it?

[deepamahadevan]

Hi do we get successfully connected to TLS 1.0 ang TLS 1.1 in vulnerability report post changes done

[aliceantony]

Hi, so is Dword, DisabledByDefault is not required is it? Cos I had to disable one of the Ciphers and I made the value for Enabled as 0, but that did not work

[marclewis]

what did you use to do the sslscan, you were originally in powershell, then switched to something else to do the scan?

[Bookemon-loho]

Should I select QWORD if it is for 64bit?