Desabilitar TLS 1.0 e 1.2 e Habilitar TLS 1.2 e 1.3 via Powershell e Checar TLS via Powershell

1. Abrir um bloco de notas e copiar o código abaixo:

#############################################################################

## Disable tls 1.0 and tls 1.1 on Windows Server using Powershell commands ##

#############################################################################

#############################################################################

##                                 TLS 1.0                                 ##

#############################################################################

## https://thesecmaster.com/how-to-disable-tls-1-0-and-tls-1-1-on-windows-server

## Server ##

New-Item 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server' -Force

New-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server' –PropertyType 'DWORD' -Name 'Enabled' -Value '0'

New-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server' –PropertyType 'DWORD' -Name 'DisabledByDefault' -Value '1'

## Client

New-Item 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Client' -Force

New-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Client' -PropertyType 'DWORD' -Name 'Enabled' -Value '0'

New-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Client' –PropertyType 'DWORD' -Name 'DisabledByDefault' -Value '1'

#############################################################################

##                                 TLS 1.1                                 ##

#############################################################################

## Server

New-Item 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server' -Force

New-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server' –PropertyType 'DWORD' -Name 'Enabled' -Value '0'

New-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server' –PropertyType 'DWORD' -Name 'DisabledByDefault' -Value '1'

## Client

New-Item 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Client' -Force

New-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Client' -PropertyType 'DWORD' -Name 'Enabled' -Value '0'

New-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Client' –PropertyType 'DWORD' -Name 'DisabledByDefault' -Value '1'

############################################################################

## Enable tls 1.2 and tls 1.3 on Windows Server using Powershell commands ##

############################################################################

## https://thesecmaster.com/how-to-enable-tls-1-2-and-tls-1-3-on-windows-server/

#############################################################################

##                                 TLS 1.2                                 ##

#############################################################################

## Client

New-Item 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client' -Force

New-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client' –PropertyType 'DWORD' -Name 'DisabledByDefault' -Value '0'

New-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client' -PropertyType 'DWORD' -Name 'Enabled' -Value '1'

### Server

New-Item 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server' -Force

New-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server' –PropertyType 'DWORD' -Name 'DisabledByDefault' -Value '0'

New-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server' –PropertyType 'DWORD' -Name 'Enabled' -Value '1'

#############################################################################

##                                 TLS 1.3                                 ##

#############################################################################

## Client

New-Item 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.3\Client' -Force

New-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.3\Client' –PropertyType 'DWORD' -Name 'DisabledByDefault' -Value '0'

New-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.3\Client' -PropertyType 'DWORD' -Name 'Enabled' -Value '1'

### Server

New-Item 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.3\Server' -Force

New-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.3\Server' –PropertyType 'DWORD' -Name 'DisabledByDefault' -Value '0'

New-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.3\Server' –PropertyType 'DWORD' -Name 'Enabled' -Value '1'

#############################################################################

##          TLS 1.3 (Supports in Windows 11 & Windows Server 2022)         ##

#############################################################################

New-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\services\HTTP\Parameters' -PropertyType 'DWORD' -Name 'EnableHttp3' -Value '1'

2. E salvar como "TLS-Disable-1.0-and-1.2-Enable-1.2-and-1.3.ps1"

3. Executar o arquivo com powershell

4. Abrir um bloco de notas e copiar e colar o código abaixo:

Function Get-RegValue {

    [CmdletBinding()]

    Param

    (

        # Registry Path

        [Parameter(Mandatory = $true,

            Position = 0)]

        [string]

        $RegPath,

        # Registry Name

        [Parameter(Mandatory = $true,

            Position = 1)]

        [string]

        $RegName

    )

    $regItem = Get-ItemProperty -Path $RegPath -Name $RegName -ErrorAction Ignore

    $output = "" | select Path, Name, Value

    $output.Path = $RegPath

    $output.Name = $RegName

    If ($regItem -eq $null) {

        $output.Value = "Not Found"

    }

    Else {

        $output.Value = $regItem.$RegName

    }

    $output

}

$regSettings = @()

$regKey = 'HKLM:\SOFTWARE\Microsoft\.NETFramework\v4.0.30319'

$regSettings += Get-RegValue $regKey 'SystemDefaultTlsVersions'

$regSettings += Get-RegValue $regKey 'SchUseStrongCrypto'

$regKey = 'HKLM:\SOFTWARE\WOW6432Node\Microsoft\.NETFramework\v4.0.30319'

$regSettings += Get-RegValue $regKey 'SystemDefaultTlsVersions'

$regSettings += Get-RegValue $regKey 'SchUseStrongCrypto'

$regKey = 'HKLM:\SOFTWARE\Microsoft\.NETFramework\v2.0.50727'

$regSettings += Get-RegValue $regKey 'SystemDefaultTlsVersions'

$regSettings += Get-RegValue $regKey 'SchUseStrongCrypto'

$regKey = 'HKLM:\SOFTWARE\WOW6432Node\Microsoft\.NETFramework\v2.0.50727'

$regSettings += Get-RegValue $regKey 'SystemDefaultTlsVersions'

$regSettings += Get-RegValue $regKey 'SchUseStrongCrypto'

$regKey = 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.3\Server'

$regSettings += Get-RegValue $regKey 'Enabled'

$regSettings += Get-RegValue $regKey 'DisabledByDefault'

$regKey = 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.3\Client'

$regSettings += Get-RegValue $regKey 'Enabled'

$regSettings += Get-RegValue $regKey 'DisabledByDefault'

$regKey = 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server'

$regSettings += Get-RegValue $regKey 'Enabled'

$regSettings += Get-RegValue $regKey 'DisabledByDefault'

$regKey = 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client'

$regSettings += Get-RegValue $regKey 'Enabled'

$regSettings += Get-RegValue $regKey 'DisabledByDefault'

$regKey = 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server'

$regSettings += Get-RegValue $regKey 'Enabled'

$regSettings += Get-RegValue $regKey 'DisabledByDefault'

$regKey = 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Client'

$regSettings += Get-RegValue $regKey 'Enabled'

$regSettings += Get-RegValue $regKey 'DisabledByDefault'

$regKey = 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server'

$regSettings += Get-RegValue $regKey 'Enabled'

$regSettings += Get-RegValue $regKey 'DisabledByDefault'

$regKey = 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Client'

$regSettings += Get-RegValue $regKey 'Enabled'

$regSettings += Get-RegValue $regKey 'DisabledByDefault'

$regSettings

5. E salvar como "TLS-Check.ps1"

6. Executar o arquivo com powershell


Fonte:

How to Enable TLS 1.2 and TLS 1.3 on Windows Server? - The Sec Master
How to Disable TLS 1.0 and TLS 1.1 on Windows Server? - The Sec Master
Check TLS settings on Windows Server with PowerShell script - ALI TAJRAN