@ECHO OFF
TITLE Enable TLS 1.2
ECHO.

REM This will enable TLS 1.2 on Windows Server 2008 SP2, Winows Server 2008 R2, and Windows 7, Windows Embedded / POSReady 2009
REM NOTE: This patch requires KB4019276 to be installed first: https://www.catalog.update.microsoft.com/Search.aspx?q=KB4019276
REM NOTE: The registry entries in this script were taken directly from Microsoft's article on the subject here:
REM NOTE:     https://support.microsoft.com/en-us/topic/update-to-add-support-for-tls-1-1-and-tls-1-2-in-windows-server-2008-sp2-windows-embedded-posready-2009-and-windows-embedded-standard-2009-b6ab553a-fa8f-3f5e-287c-e752eb3ce5f4
REM NOTE: A reboot is required after this script is run.

REM Determine whether system is 64-bit or 32-bit
REG QUERY "HKLM\Hardware\Description\System\CentralProcessor\0" | FIND /i "x86" > NUL && SET _IS64BIT=false || SET _IS64BIT=true

REM Add registry entries for 64-bit system. This prevents keys being added to WOW6432Node subkey if this script is run by 32-bit process on a 64-bit machine
IF %_IS64BIT% EQU true (
ECHO Adding registry entries for 64-bit system...
REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2" /reg:64
REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client" /reg:64
REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client" /v DisabledByDefault /t REG_DWORD /d 0 /f /reg:64
REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client" /v Enabled /t REG_DWORD /d 1 /f /reg:64
REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server" /reg:64
REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server" /v DisabledByDefault /t REG_DWORD /d 0 /f /reg:64
REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server" /v Enabled /t REG_DWORD /d 1 /f /reg:64
SET _FIXED=true
)

REM Add registry entries for 32-bit system.
IF %_IS64BIT% EQU false (
ECHO Adding registry entries for 32-bit system...
REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2"
REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client"
REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client" /v DisabledByDefault /t REG_DWORD /d 0 /f
REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client" /v Enabled /t REG_DWORD /d 1 /f
REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server"
REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server" /v DisabledByDefault /t REG_DWORD /d 0 /f
REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server" /v Enabled /t REG_DWORD /d 1 /f
SET _FIXED=true
)

REM Let the user know whether the fix was applied or not
ECHO.
IF %_FIXED% EQU true (
ECHO Success! TLS 1.2 has been enabled, please restart this device for the change to take effect.
) ELSE (
ECHO Something went wrong and TLS 1.2 is not enabled on this device.
)