Disable TLS 1.0 for RDP Protocol using GPO

Federico Coppola 1,181 Reputation points
2020-11-26T14:45:11.99+00:00

Hi all,
Inside company we have completed a vulnerability assessment.
I have this vulnerability:

"TLS Version 1.0 Protocol Detection"

All physical servers and virtual machine inside company are Windows Server 2016 DataCenter and they has got the last Windows Updates.

How can I solve it about RDP?
Is it possible disable TLS 1.0 for RDP using GPO?

I would improve security on company servers.

Thanks so much

Best regards
Federico

Windows Server 2016
Windows Server 2016
A Microsoft server operating system that supports enterprise-level management updated to data storage.
2,391 questions
Remote Desktop
Remote Desktop
A Microsoft app that connects remotely to computers and to virtual apps and desktops.
4,266 questions
Windows Server Security
Windows Server Security
Windows Server: A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.Security: The precautions taken to guard against crime, attack, sabotage, espionage, or another threat.
1,732 questions
0 comments

7 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Thameur-BOURBITA 32,586 Reputation points
    2020-11-26T22:48:07.44+00:00

    Hi,

    You can use Group policy preference to disable or enable TLS 1.0 by setting this registry key mentioned on this link :

    tls-registry-settings

    Please don't forget to mark this reply as answer if it help you to fix your issue

    0 comments
  2. Vicky Wang 2,646 Reputation points
    2020-11-27T07:52:42.833+00:00

    Disabling TLS is a system-wide registry setting:

    https://technet.microsoft.com/en-us/library/dn786418.aspx#BKMK_SchannelTR_TLS10

    Key: HKLM SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server
    Value: Enabled
    Value type: REG_DWORD
    Value Data: 0
    Also, the PCI requirement for disabling early TLS does not go into effect until June 30, 2016.

    Internet Explorer is one product I know of that has a separate configuration option for the TLS/SSL encryption settings. There may be others.

    I have a Windows 2012 R2 server with TLS 1.0 disabled and I can remote desktop to it.

    If you are wondering, below is a screenshot of tsconfig.msc on a Windows 2008 R2 server that has KB3080079 installed. There's nothing to configure because the only thing the update did was add support for the other two TLS encryption levels so that when TLS 1.0 is disabled it continues to work.
    43118-capture3.png

    Hope this information can help you
    Best wishes
    Vicky

    0 comments
  3. Federico Coppola 1,181 Reputation points
    2020-11-29T21:18:10.817+00:00

    Hi,
    thanks for you reply.

    @Thameur-BOURBITA Ok, so I will disable TLS 1.0 for all system and not just for RDP.

    @Vicky Wang Sorry but I did not understood which is the right option about "Remote Desktop Session Host Configuration"

    I would generally disable TLS 1.0 to improve security in my LAN where there are differente Windows Server 2016 VM (Domain Controllers, File Server, Print server...)

    Can I create a group policy to disable it on different machines?

    Thanks so much
    Federico

    0 comments
  4. Federico Coppola 1,181 Reputation points
    2020-12-02T20:07:38.68+00:00

    Can anyone suggest me properly GPO to set to disable TLS 1.0 on different servers?
    Not servers are Terminal Server (just one at the moment).

    Thanks
    Federico

    0 comments
  5. Vicky Wang 2,646 Reputation points
    2020-12-03T09:21:50.59+00:00

    Hi,
    According to my knowledge, there is no GPO that can disable the terminal server
    Best wishes
    Vicky

    0 comments