Terminal Services Encryption Level is not FIPS-140 Compliant

Question

question

NemalikondaPChari-4767 asked Oct 21, '20 ElevenYu-MSFT commented Oct 26, '20

Terminal Services Encryption Level is not FIPS-140 Compliant

Please suggest me fix for this vulnerability

windows-server-2012

· 2

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

ElevenYu-MSFT · Oct 23, 2020 at 07:57 AM

Hi,

Have you checked if the answer helps?

If the Answer is helpful, please click "Accept Answer" and upvote it.

Thanks,
ELeven

0 ·

ElevenYu-MSFT · Oct 26, 2020 at 06:52 AM

Hi,

May I know if you have further questions?

If no, could you please click "Accept Answer" and upvote it, if the answer is helpful?

Thanks,
Eleven

0 ·

Answer 1 · 2020-10-22T03:07:49.723Z

ElevenYu-MSFT answered Oct 22, '20

Hi,

You can use group policy or registry key on the terminal server to set the Encryption Level.

Group Policy:

Computer Configuration\Windows Settings\Security Settings\Security Options - System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing

Registry:

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Policies\Microsoft\Windows NT\Terminal Services]
“MinEncryptionLevel” REG_DWORD set the value to 4
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\Winstations\RDP-Tcp]
“MinEncryptionLevel” REG_DWORD set the value to 4

For your reference
https://docs.microsoft.com/en-us/windows/security/threat-protection/fips-140-validation

Thanks,
Eleven

If the Answer is helpful, please click "Accept Answer" and upvote it.

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

question