emberkom/management-scripts
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

overhaul to enable TLS 1.2

Browse Source
This commit is contained in:
dyoder
2021-08-05 12:15:18 -04:00
parent 96e2af2dda
commit 54d75a842a
1 changed files with 44 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Fix-WindowsTLS.bat
+44 -3
View File
@@ -1,3 +1,44 @@
@echo off @ECHO OFF
reg add HKLM\SOFTWARE\Microsoft\.NETFramework\v4.0.30319 /v SystemDefaultTlsVersions /t REG_DWORD /d 1 /f /reg:64 TITLE Enable TLS 1.2
reg add HKLM\SOFTWARE\Microsoft\.NETFramework\v4.0.30319 /v SystemDefaultTlsVersions /t REG_DWORD /d 1 /f /reg:32 ECHO.
REM This will enable TLS 1.2 on Windows Server 2008 SP2, Winows Server 2008 R2, and Windows 7, Windows Embedded / POSReady 2009
REM NOTE: This patch requires KB4019276 to be installed first: https://www.catalog.update.microsoft.com/Search.aspx?q=KB4019276
REM NOTE: A reboot is required after this script is run.
REM Determine whether system is 64-bit or 32-bit
REG QUERY "HKLM\Hardware\Description\System\CentralProcessor\0" | FIND /i "x86" > NUL && SET _IS64BIT=false || SET _IS64BIT=true
REM Add registry entries for 64-bit system. This prevents keys being added to WOW6432Node subkey if this script is run by 32-bit process on a 64-bit machine
IF %_IS64BIT% EQU true (
ECHO Adding registry entries for 64-bit system...
REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2" /reg:64
REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client" /reg:64
REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client" /v DisabledByDefault /t REG_DWORD /d 0 /f /reg:64
REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client" /v Enabled /t REG_DWORD /d 1 /f /reg:64
REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server" /reg:64
REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server" /v DisabledByDefault /t REG_DWORD /d 0 /f /reg:64
REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server" /v Enabled /t REG_DWORD /d 1 /f /reg:64
SET _FIXED=true
)
REM Add registry entries for 32-bit system.
IF %_IS64BIT% EQU false (
ECHO Adding registry entries for 32-bit system...
REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2"
REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client"
REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client" /v DisabledByDefault /t REG_DWORD /d 0 /f
REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client" /v Enabled /t REG_DWORD /d 1 /f
REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server"
REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server" /v DisabledByDefault /t REG_DWORD /d 0 /f
REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server" /v Enabled /t REG_DWORD /d 1 /f
SET _FIXED=true
)
REM Let the user know whether the fix was applied or not
ECHO.
IF %_FIXED% EQU true (
ECHO Success! TLS 1.2 has been enabled, please restart this device for the change to take effect.
) ELSE (
ECHO Something went wrong and TLS 1.2 is not enabled on this device.
)