How to Disable TLS 1.0 and TLS 1.1 on Windows Server? (2024)

Table of Contents
How to Disable TLS 1.0 and TLS 1.1 on Windows Server? A Short Note About TLS 1.0 and TLS 1.1: Why You Should Disable TLS 1.0 and TLS 1.1 on Windows Server? Attacks TLS 1.0 and TLS 1.1 are vulnerable to: What is the Alternate to TLS 1.0 and TLS 1.1? How to Disable TLS 1.0 and TLS 1.1 on Windows Server? Method 1 : Disable TLS 1.0 and TLS 1.1 manually using Registry Method 2 : Disable TLS 1.0 and TLS 1.1 using Powershell commands Method 3 : Disable TLS 1.0 and TLS 1.1 on Windows Server using CMD Similar Posts: Frequently Asked Questions: Keep Exploring

How to Disable TLS 1.0 and TLS 1.1 on Windows Server?

Growing trends in cyber attacks made system administrators implement more secure communication protocols to protect their assets and network from attacks. TLS plays a vital role in the implementation stack. TLS is a critical security protocol that is used to encrypt communications between clients and servers. TLS 1.2 and TLS 1.3 are the two latest versions of the Transport Layer Security (TLS) protocol and offer many advantages over their previous versions. TLS 1.2 is the most widely used version of the TLS protocol, but TLS 1.3 is gaining popularity because of its efficiency and speed. As a system administrator, you should enable TLS 1.2 and TLS 1.3 on your Windows Server to enhance the security of your infrastructure, but wait, that’s not enough. You should disable TLS 1.0 and TLS 1.1 on Windows Server as they are deprecated for their weak security.

Before learning how to disable TLS 1.0 and TLS 1.1 on your Windows Server, let’s see about TLS 1.0 and TLS 1.1 and why you should disable TLS 1.0 and TLS 1.1 on your Windows Server

Table of Contents

A Short Note About TLS 1.0 and TLS 1.1:

The Transport Layer Security (TLS) protocols are cryptographic protocols that provide communication security over the Internet. TLS 1.0 and TLS 1.1 are the two previous versions of the TLS protocol.

TLS 1.0 was first defined in 1999, and TLS 1.1 was published as an update to TLS 1.0 in 2006. TLS 1.0 and TLS 1.1 are now considered to be obsolete, and they are no longer considered secure.

Why You Should Disable TLS 1.0 and TLS 1.1 on Windows Server?

There are a few reasons why you should disable TLS 1.0 and TLS 1.1 on Windows Server:

  1. TLS 1.0 and TLS 1.1 are no longer considered secure, due to the fact that they are vulnerable to various attacks, such as the POODLE attack.
  2. Disabling TLS 1.0 and TLS 1.1 on your server will force clients to use a more secure protocol (TLS 1.2), which is less vulnerable to attack.
  3. Some government agencies, such as the US National Security Agency (NSA), have recommended that TLS 1.0 and TLS 1.1 be disabled.
  4. Microsoft will no longer provide security updates for Windows Server running TLS 1.0 and TLS 1.1.
  5. Many major software vendors are phasing out support for TLS 1.0 and TLS 1.1. This includes Google, Microsoft, Mozilla, and Apple.

Attacks TLS 1.0 and TLS 1.1 are vulnerable to:

There are a number of known vulnerabilities in TLS 1.0 and TLS 1.1 that can be exploited by attackers. These include:

  1. POODLE (Padding Oracle On Downgraded Legacy Encryption)
  2. BEAST (Browser Exploit Against SSL/TLS)
  3. CRIME (Compression Ratio Info-leak Made Easy)
  4. FREAK (Factoring Attack on RSA-EXPORT Keys)
  5. LOGJAM (Diffie-Hellman Key Exchange Weakness)

These vulnerabilities allow attackers to perform man-in-the-middle attacks, decrypt sensitive information, and hijack user sessions. By disabling TLS 1.0 and TLS 1.1 on your Windows server, you can protect yourself from these attacks.

What is the Alternate to TLS 1.0 and TLS 1.1?

The current version of the TLS protocol is TLS 1.3. TLS 1.3 was first defined in 2018, and it includes a number of security improvements over previous versions of the TLS protocol. We suggest you to enable TLS 1.2 and TLS 1.3 on your Windows Server instead of TLS 1.0 and TLS 1.1.

TLS 1.2 improves upon TLS 1.1 by adding support for Elliptic Curve Cryptography (ECC) and introducing new cryptographic suites that offer better security than the suites used in TLS 1.1. TLS 1.3 improves upon TLS 1.2 by simplifying the handshake process and making it more resistant to man-in-the-middle attacks. In addition, TLS 1.3 introduces new cryptographic suites that offer better security than the suites used in TLS 1.2.

TLS 1.2 and TLS 1.3 are both backward compatible with TLS 1.1 and earlier versions of the protocol. This means that a client that supports TLS 1.2 can communicate with a server that supports TLS 1.1 and vice versa. However, TLS 1.2 and TLS 1.3 are not compatible with each other. A client that supports TLS 1.2 cannot communicate with a server that supports TLS 1.3, and vice versa.

TLS 1.2 is the most widely used version of the TLS protocol, but TLS 1.3 is gaining in popularity. Many major web browsers, including Google Chrome, Mozilla Firefox, and Microsoft Edge, now support TLS 1.3. In addition, major Internet services providers, such as Cloudflare and Akamai, have started to support TLS 1.3 on their servers. Please visit this page if you want to deeply review the comparison of TLS implementations across different supported servers and clients.

Please visit these posts to learn more about TLS 1.2 and TLS 1.3:

  1. What Is SSL/TLS? How SSL, TLS 1.2, And TLS 1.3 Differ From Each Other?
  2. Decoding TLS v1.2 protocol Handshake with Wireshark
  3. Decoding TLS 1.3 Protocol Handshake With Wireshark
  4. How to Enable TLS 1.3 in Standard Web Browsers?
  5. How to Enable TLS 1.3 on Popular Web Servers?
  6. How to Enable TLS 1.2 and TLS 1.3 on Windows Server
  7. How to Disable TLS 1.0 and TLS 1.1 on Your Apache Server?
  8. How to Disable TLS 1.0 and TLS 1.1 on Your Nginx Server?

How to Disable TLS 1.0 and TLS 1.1 on Windows Server?

We have covered 3 different ways to disable TLS 1.0 and TLS 1.1 on your Windows Server in this post. You can choose any one of the three ways to disable TLS 1.0 and TLS 1.1 on your Windows Server depending on your technical and automation skills.

  1. Disable TLS 1.0 and TLS 1.1 manually using Registry
  2. Disable TLS 1.0 and TLS 1.1 using Powershell Commands
  3. Disable TLS 1.0 and TLS 1.1 using CMD

Note:Microsoft clearly said that it doesn’t support TLS 1.0 and TLS 1.1 on Windows operating systems. No patches will be provided for TLS 1.0 and TLS 1.1 from Microsoft. You can refer to the below table that shows the Microsoft Schannel Providersupport of TLS protocolversions.

TLS Protocols Supported by Windows Operating Systems:

Windows OSTLS 1.0 ClientTLS 1.0 ServerTLS 1.1 ClientTLS 1.1 ServerTLS 1.2 ClientTLS 1.2 ServerTLS 1.3 ClientTLS 1.3 Server
WindowsVista/Windows Server2008EnabledEnabledNot supportedNot supportedNot supportedNot supportedNot supportedNot supported
Windows Server2008 with Service Pack2 (SP2)EnabledEnabledDisabledDisabledDisabledDisabledNot supportedNot supported
Windows7/Windows Server2008R2EnabledEnabledDisabledDisabledDisabledDisabledNot supportedNot supported
Windows8/Windows Server2012EnabledEnabledEnabledEnabledEnabledEnabledNot supportedNot supported
Windows8.1/Windows Server2012R2EnabledEnabledEnabledEnabledEnabledEnabledNot supportedNot supported
Windows10, version 1507EnabledEnabledEnabledEnabledEnabledEnabledNot supportedNot supported
Windows10, version 1511EnabledEnabledEnabledEnabledEnabledEnabledNot supportedNot supported
Windows10, version 1607/Windows Server2016 StandardEnabledEnabledEnabledEnabledEnabledEnabledNot supportedNot supported
Windows10, version 1703EnabledEnabledEnabledEnabledEnabledEnabledNot supportedNot supported
Windows10, version 1709EnabledEnabledEnabledEnabledEnabledEnabledNot supportedNot supported
Windows10, version 1803EnabledEnabledEnabledEnabledEnabledEnabledNot supportedNot supported
Windows10, version 1809//Windows Server2019EnabledEnabledEnabledEnabledEnabledEnabledNot supportedNot supported
Windows10, version 1903EnabledEnabledEnabledEnabledEnabledEnabledNot supportedNot supported
Windows10, version 1909EnabledEnabledEnabledEnabledEnabledEnabledNot supportedNot supported
Windows10, version 2004EnabledEnabledEnabledEnabledEnabledEnabledNot supportedNot supported
Windows10, version 20H2EnabledEnabledEnabledEnabledEnabledEnabledNot SupportedNot Supported
Windows10, version 21H1EnabledEnabledEnabledEnabledEnabledEnabledNot SupportedNot Supported
Windows10, version 21H2EnabledEnabledEnabledEnabledEnabledEnabledNot SupportedNot Supported
WindowsServer 2022EnabledEnabledEnabledEnabledEnabledEnabledEnabledEnabled
Windows11EnabledEnabledEnabledEnabledEnabledEnabledEnabledEnabled

Method 1 : Disable TLS 1.0 and TLS 1.1 manually using Registry

Let’s begin learning how to disable TLS 1.0 and TLS 1.1 manually using Windows Registry.

Time needed:15 minutes

  1. Open regedit utility

    Open ‘Run‘, type ‘regedit’ and click ‘OK’.

    How to Disable TLS 1.0 and TLS 1.1 on Windows Server? (1)

  2. Create New Key

    In Registry Editor, navigate to the path :Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols.
    Create a new key by Right click on ‘Protocols‘ –> New –> Key.

    How to Disable TLS 1.0 and TLS 1.1 on Windows Server? (2)

  3. Rename the Registry Key ‘TLS 1.0’

    Name key as ‘TLS 1.0‘
    Rename the registry key as ‘TLS 1.0‘.

    How to Disable TLS 1.0 and TLS 1.1 on Windows Server? (3)

  4. Create One More Registry Key ‘Client’ underneath ‘TLS 1.0’

    As smiler to the above step, create another key as ‘Client‘ underneath ‘TLS 1.0‘ as shone in this picture.How to Disable TLS 1.0 and TLS 1.1 on Windows Server? (4)

  5. Create New Item ‘DWORD (32-bit) Value’ Underneath ‘Client’

    Create new item by right click on ‘Client‘, select ‘New’ –> DWORD (32-bit) Value.

    How to Disable TLS 1.0 and TLS 1.1 on Windows Server? (5)

  6. Rename the Item ‘DWORD (32-bit) Value’ to ‘Enable’

    We Name the item as ‘Enabled‘ with Hexadecimal value as ‘0‘.

    How to Disable TLS 1.0 and TLS 1.1 on Windows Server? (6)

  7. Create another item, ‘DisabledByDefault’ Underneath TLS 1.0

    Similarly, create another item, ‘DisabledByDefault‘, with a Hexadecimal value as ‘1‘.

    How to Disable TLS 1.0 and TLS 1.1 on Windows Server? (7)

  8. Create ‘Server’ and corresponding Keys as in the case of ‘Client’

    Similar to the above steps, create a key ‘Server‘ under ‘Protocols‘ and create registry items ‘DWORD (32-bit)’ and ‘Enabled’ as shown below.

    How to Disable TLS 1.0 and TLS 1.1 on Windows Server? (8)

  9. Disable TLS 1.1 on the Windows Server

    Similar to the above steps, create a key ‘TLS 1.1’ under ‘Protocols‘ and below keys and items to Disable ‘TLS 1.1’

    > HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Client\Enabled with Hexadecimal value as ‘0’
    > HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Client\DisabledByDefault with Hexadecimal value as ‘1’

    > HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server\Enabled with Hexadecimal value as ‘0’
    > HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server\DisabledByDefault with Hexadecimal value as ‘1’

  10. How to Disable TLS 1.0 and TLS 1.1 on Windows Server? (9)

Method 2 : Disable TLS 1.0 and TLS 1.1 using Powershell commands

Follow this simple procedure to enable TLS 1.2 and TLS 1.2 using Powershell commands.

See Also
How to know which versions of TLS is/are enabled on Windows Server 2019? - Microsoft Q&AAllow cookies and SSL in your browserTLS 1.2 Transport Layer Security ProtocolConfigure TLS 1.2 on Windows clients accessing Azure Stack Edge Pro GPU device

  1. Open Powershell as Administrator
How to Disable TLS 1.0 and TLS 1.1 on Windows Server? (10)

2. Run the below commands to create Registry entries

- New-Item 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server' -Force- New-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server' –PropertyType 'DWORD' -Name 'Enabled' -Value '0' - New-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server' –PropertyType 'DWORD' -Name 'DisabledByDefault' -Value '1' - New-Item 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Client' -Force- New-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Client' -PropertyType 'DWORD' -Name 'Enabled' -Value '0'- New-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Client' –PropertyType 'DWORD' -Name 'DisabledByDefault' -Value '1' - New-Item 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server' -Force- New-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server' –PropertyType 'DWORD' -Name 'Enabled' -Value '0' - New-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server' –PropertyType 'DWORD' -Name 'DisabledByDefault' -Value '1' - New-Item 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Client' -Force- New-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Client' -PropertyType 'DWORD' -Name 'Enabled' -Value '0'- New-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Client' –PropertyType 'DWORD' -Name 'DisabledByDefault' -Value '1'

Before running the commands, you can see no items exist underneath Protocol.

How to Disable TLS 1.0 and TLS 1.1 on Windows Server? (11)

After running the commands you can see there are two keys created ‘TLS 1.0’ & ‘TLS 1.1’, Underneath each protocols there are ‘Client’ &’Server’ Keys inside them ther are two items ‘DisableByDefault’ & ‘Enabled’.

How to Disable TLS 1.0 and TLS 1.1 on Windows Server? (12)

Method 3 : Disable TLS 1.0 and TLS 1.1 on Windows Server using CMD

Follow this simple procedure to disable TLS 1.0 and TLS 1.1 using CMD comments.

  1. Open ‘Command Prompt’ as Administrator
How to Disable TLS 1.0 and TLS 1.1 on Windows Server? (13)

2. Run the below commands to create Registry entries.

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server" /v Enabled /t REG_DWORD /d 0 /f reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server" /v DisabledByDefault /t REG_DWORD /d 1 /freg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Client" /v Enabled /t REG_DWORD /d 0 /f reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Client" /v DisabledByDefault /t REG_DWORD /d 1 /freg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server" /v Enabled /t REG_DWORD /d 0 /f reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server" /v DisabledByDefault /t REG_DWORD /d 1 /freg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Client" /v Enabled /t REG_DWORD /d 0 /f reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Client" /v DisabledByDefault /t REG_DWORD /d 1 /f

We hope this post would help you know how to disable TLS 1.0 and TLS 1.1 on your Windows Server as they are deprecated for their weak security. Please share this post if you find this interested. Visit our social media page on Facebook, LinkedIn, Twitter, Telegram, Tumblr, Medium & Instagram, and subscribe to receive updates like this.

Recommend Products for You

We have some computer accessory recommendations that we think you’ll find useful. These are products we’ve personally selected that we believe are must-haves for any computer. Take a moment to look through the list – you can click on any item to view more details or purchase it directly from Amazon. Whether you’re just getting started with your computer or looking to expand its capabilities, we’re confident you’ll find something helpful among our top picks. Let us know if you have any other questions!

Declaimer: The below products contain affiliate links. We may receive a small commission if you purchase through these links at no additional cost to you. You can read our full affiliate disclosure here.

Read More:

Frequently Asked Questions:

1. What are TLS 1.0 and TLS 1.1?

TLS 1.0 and TLS 1.1 are older versions of the Transport Layer Security (TLS) protocol, which is designed to provide secure communication over computer networks. These versions have been deprecated due to various security vulnerabilities and have been replaced by more secure and modern versions like TLS 1.2 and TLS 1.3.TLS 1.0 and TLS 1.1 are older versions of the Transport Layer Security (TLS) protocol, which is designed to provide secure communication over computer networks. These versions have been deprecated due to various security vulnerabilities and have been replaced by more secure and modern versions like TLS 1.2 and TLS 1.3.

2. Why should I disable TLS 1.0 and TLS 1.1 on my Windows Server?

Disabling TLS 1.0 and TLS 1.1 on your Windows Server helps protect your server from potential security vulnerabilities and ensures compliance with security standards and best practices. It also encourages clients to use more secure and modern versions of the TLS protocol, such as TLS 1.2 and TLS 1.3.

3. How do I disable TLS 1.0 and TLS 1.1 on my Windows Server?

To disable TLS 1.0 and TLS 1.1 on your Windows Server, follow these steps:

1. Open the Registry Editor by pressing Win + R, typing regedit, and pressing Enter.
2. Navigate to the following registry key:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols
3. Under the Protocols key, create new keys for TLS 1.0 and TLS 1.1 if they do not exist.
4. Under each TLS version key, create subkeys named Client and Server.
5. Create a new DWORD (32-bit) value named Enabled under both Client and Server subkeys, and set its value to 0.
6. Create a new DWORD (32-bit) value named DisabledByDefault under both Client and Server subkeys, and set its value to 1.
7. Close the Registry Editor and restart your server to apply the changes.

4. Can I disable TLS 1.0 and TLS 1.1 on other operating systems besides Windows Server?

Yes, you can disable TLS 1.0 and TLS 1.1 on other operating systems, such as Linux and macOS. The process may vary depending on the platform and the software used, but the overall goal remains the same: to ensure that your server no longer accepts connections using less secure versions of the TLS protocol.

5. Will disabling TLS 1.0 and TLS 1.1 affect the compatibility of my Windows Server with older clients?

Disabling TLS 1.0 and TLS 1.1 may affect compatibility with older clients that do not support more modern versions of the TLS protocol. However, the majority of modern web browsers, applications, and devices now support TLS 1.2 and TLS 1.3. It is highly recommended to encourage clients to update their software to support these newer and more secure versions of the TLS protocol.

6. How do I check if TLS 1.0 and TLS 1.1 are disabled on my Windows Server?

You can use a third-party tool like Nmap (https://nmap.org/) or SSL Labs’ SSL Server Test (https://www.ssllabs.com/ssltest/) to scan your server and determine if TLS 1.0 and TLS 1.1 are disabled.

7. Do I need to update my server’s SSL/TLS certificates after disabling TLS 1.0 and TLS 1.1?

Disabling TLS 1.0 and TLS 1.1 on your Windows Server does not require updating your existing SSL/TLS certificates. However, it is essential to ensure that your certificates are valid, up to date, and issued by a trusted Certificate Authority (CA). If your certificates are about to expire or if you have concerns about their security, consider obtaining new certificates to maintain a secure and trustworthy connection.

8. Can I disable TLS 1.0 and TLS 1.1 for specific applications or services on my Windows Server?

Yes, you can disable TLS 1.0 and TLS 1.1 for specific applications or services on your Windows Server. The process may vary depending on the application or service, but it typically involves configuring the application’s settings or modifying its configuration files. Refer to the documentation for the specific application or service for more information on how to disable the older TLS versions.

9. How do I ensure that my Windows Server is using the most secure encryption standards after disabling TLS 1.0 and TLS 1.1?

To ensure that your Windows Server is using the most secure encryption standards after disabling TLS 1.0 and TLS 1.1, follow these steps:

1. Enable the latest versions of the TLS protocol, such as TLS 1.2 and TLS 1.3, following the instructions provided in the FAQ about enabling TLS 1.2 and TLS 1.3 on Windows Server.
2. Regularly update your server’s operating system and installed software to apply security patches and improvements.
3. Use strong cipher suites that provide robust encryption, authentication, and key exchange.
4. Keep your SSL/TLS certificates up to date and ensure they are issued by a trusted Certificate Authority (CA).

10. What are the potential security risks of not disabling TLS 1.0 and TLS 1.1?

Not disabling TLS 1.0 and TLS 1.1 can expose your Windows Server to several potential security risks, including:

1. Vulnerabilities in the older TLS protocol versions, such as BEAST, POODLE, and DROWN.
2. Weak encryption algorithms and cipher suites that are easier for attackers to exploit.
3. Non-compliance with security standards and best practices, which may lead to penalties or reputational damage.
4. Reduced compatibility with modern clients that prefer or require more secure versions of the TLS protocol.

11. How do I monitor the TLS connections on my Windows Server?

To monitor the TLS connections on your Windows Server, you can use built-in tools, such as Performance Monitor or Event Viewer, or third-party monitoring solutions that provide more detailed information and analysis. By monitoring your server’s TLS connections, you can ensure that your server is using the desired versions of the TLS protocol, identify potential security issues, and optimize your server’s performance.

About the author

How to Disable TLS 1.0 and TLS 1.1 on Windows Server? (48)

Arun KL

Arun KL is a cybersecurity professional with 15+ years of experience spanning IT infrastructure, cloud security, vulnerability management, Penetration Testing, security operations, and incident response. He is adept at designing and implementing robust security solutions to safeguard systems and data. Arun holds multiple industry certifications including CCNA, CCNA Security, RHCE, CEH, and AWS Security.

To know more about him, you can visit his profile on LinkedIn.

Leave a Reply

  1. The line breaks in the cmd sample aren't quite right.

    reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Client" /v Enabled /t REG_DWORD /d 0 /f reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Client" /v DisabledByDefault /t REG_DWORD /d 1 /f

    should be

    reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Client" /v Enabled /t REG_DWORD /d 0 /f
    reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Client" /v DisabledByDefault /t REG_DWORD /d 1 /f

    Reply

    1. Thanks for the correction. It helps other too.

      Reply

  2. Hi Arun,

    You wrote

    "How to Disable TLS 1.0 and TLS 1.1 on Windows Server?
    We have covered 3 different ways to disable TLS 1.2 and TLS 1.3 on your Windows Server in this post. You can choose any one of the three ways to disable TLS 1.2 and TLS 1.3 on your Windows Server depending on your technical and automation skills."

    But don't you mean:

    "How to Disable TLS 1.0 and TLS 1.1 on Windows Server?
    We have covered 3 different ways to disable TLS 1.0 and TLS 1.1 on your Windows Server in this post. You can choose any one of the three ways to disable TLS 1.0 and TLS 1.1 on your Windows Server depending on your technical and automation skills."

    Steps by steps are very well explained but they show disabling TLS 1.0 and TLS 1.1 and not TLS 1.2 and 1.3

    Reply

    1. Thanks, Louise for notifying this. It’s been corrected now.

      Reply

  3. Great blog post Arun. Please note, these changes do not come into affect until a reboot/restart is done.

    Richard.

    Reply

    1. Thanks, Richard. Your comments will be published as this information give other readers a reminder about the reboot.

      Reply

  4. Great tutorial!! as a newbie admin like me help a lot to know a few method to modify the win registry , method 3 by far the best for me.

    Reply

    1. Hi Bill,

      We are pleased to know that this piece of information is useful for someone. Thanks for your comments!

      Reply

  5. Methos 1 has a few errors – seems like you have switched what should be disabled and what should be enabled:

    > HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Client\Enabled with Hexadecimal value as ‘1’ – SHOULD BE SET TO 0!
    > HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Client\DisabledByDefault with Hexadecimal value as ‘0’ – SHOULD BE SET TO 1!

    > HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server\Enabled with Hexadecimal value as ‘1’ – SHOULD BE SET TO 0!
    > HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server\DisabledByDefault with Hexadecimal value as ‘0’ – SHOULD BE SET TO 1!

    Reply

    1. Thanks, Gorm.

      You are absolutely correct. We will correct the error and update it again.

      Reply

  6. This content compiles factual information which has helped me a lot as a reader.

    Reply

    1. We are pleased to hear that. Thanks for your comment.

      Reply

I'm an experienced cybersecurity professional with over 15 years of expertise, encompassing various domains such as IT infrastructure, cloud security, vulnerability management, penetration testing, security operations, and incident response. Holding certifications like CCNA, CCNA Security, RHCE, CEH, and AWS Security, I've demonstrated my commitment to staying current in the rapidly evolving field of cybersecurity.

In the article, "How to Disable TLS 1.0 and TLS 1.1 on Windows Server," the author discusses the growing trends in cyber attacks and the need for system administrators to implement more secure communication protocols. The article emphasizes the importance of Transport Layer Security (TLS) in securing communication between clients and servers, with a focus on the deprecated versions TLS 1.0 and TLS 1.1.

The author provides evidence of expertise by detailing the vulnerabilities associated with TLS 1.0 and TLS 1.1, including known attacks such as POODLE, BEAST, CRIME, FREAK, and LOGJAM. Additionally, the article highlights recommendations from government agencies like the US National Security Agency (NSA) to disable these outdated TLS versions.

The suggested alternative to TLS 1.0 and TLS 1.1 is presented as TLS 1.3, with a brief overview of its security improvements over previous versions. The article guides system administrators on how to disable TLS 1.0 and TLS 1.1 on Windows Server through three methods: manual Registry modification, PowerShell commands, and CMD commands.

Furthermore, the author includes a table detailing TLS protocol support in various Windows operating systems and emphasizes Microsoft's discontinuation of security updates for servers running TLS 1.0 and TLS 1.1.

The article concludes by addressing frequently asked questions, providing additional information on related topics, and suggesting products related to computer accessories.

In summary, the article demonstrates a deep understanding of cybersecurity, TLS protocols, and Windows Server configurations, providing valuable guidance for system administrators aiming to enhance the security of their infrastructure.

How to Disable TLS 1.0 and TLS 1.1 on Windows Server? (2024)
Top Articles
Best Leverage for forex
The 7 Best Landlord Insurance Companies
O Tradicional Baralho Cigano Lenormand 36 cartas Plastificado com manual explicativo - Bialluz Presentes - Tarô / Baralho Cigano - Magazine Coelhonojapao
Magia com Tarot - Loja Terapias de Luz
Latest Posts
What is leverage?
Scalping Trading Strategy: High Leverage, Little Time and Few Pips at a Time
Article information

Author: Prof. Nancy Dach

Last Updated:

Views: 6139

Rating: 4.7 / 5 (77 voted)

Reviews: 84% of readers found this page helpful

Author information

Name: Prof. Nancy Dach

Birthday: 1993-08-23

Address: 569 Waelchi Ports, South Blainebury, LA 11589

Phone: +9958996486049

Job: Sales Manager

Hobby: Web surfing, Scuba diving, Mountaineering, Writing, Sailing, Dance, Blacksmithing

Introduction: My name is Prof. Nancy Dach, I am a lively, joyous, courageous, lovely, tender, charming, open person who loves writing and wants to share my knowledge and understanding with you.