46 lines
3.2 KiB
Batchfile
46 lines
3.2 KiB
Batchfile
@ECHO OFF
|
|
TITLE Enable TLS 1.2
|
|
ECHO.
|
|
|
|
REM This will enable TLS 1.2 on Windows Server 2008 SP2, Winows Server 2008 R2, and Windows 7, Windows Embedded / POSReady 2009
|
|
REM NOTE: This patch requires KB4019276 to be installed first: https://www.catalog.update.microsoft.com/Search.aspx?q=KB4019276
|
|
REM NOTE: The registry entries in this script were taken directly from Microsoft's article on the subject here:
|
|
REM NOTE: https://support.microsoft.com/en-us/topic/update-to-add-support-for-tls-1-1-and-tls-1-2-in-windows-server-2008-sp2-windows-embedded-posready-2009-and-windows-embedded-standard-2009-b6ab553a-fa8f-3f5e-287c-e752eb3ce5f4
|
|
REM NOTE: A reboot is required after this script is run.
|
|
|
|
REM Determine whether system is 64-bit or 32-bit
|
|
REG QUERY "HKLM\Hardware\Description\System\CentralProcessor\0" | FIND /i "x86" > NUL && SET _IS64BIT=false || SET _IS64BIT=true
|
|
|
|
REM Add registry entries for 64-bit system. This prevents keys being added to WOW6432Node subkey if this script is run by 32-bit process on a 64-bit machine
|
|
IF %_IS64BIT% EQU true (
|
|
ECHO Adding registry entries for 64-bit system...
|
|
REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2" /reg:64
|
|
REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client" /reg:64
|
|
REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client" /v DisabledByDefault /t REG_DWORD /d 0 /f /reg:64
|
|
REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client" /v Enabled /t REG_DWORD /d 1 /f /reg:64
|
|
REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server" /reg:64
|
|
REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server" /v DisabledByDefault /t REG_DWORD /d 0 /f /reg:64
|
|
REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server" /v Enabled /t REG_DWORD /d 1 /f /reg:64
|
|
SET _FIXED=true
|
|
)
|
|
|
|
REM Add registry entries for 32-bit system.
|
|
IF %_IS64BIT% EQU false (
|
|
ECHO Adding registry entries for 32-bit system...
|
|
REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2"
|
|
REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client"
|
|
REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client" /v DisabledByDefault /t REG_DWORD /d 0 /f
|
|
REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client" /v Enabled /t REG_DWORD /d 1 /f
|
|
REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server"
|
|
REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server" /v DisabledByDefault /t REG_DWORD /d 0 /f
|
|
REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server" /v Enabled /t REG_DWORD /d 1 /f
|
|
SET _FIXED=true
|
|
)
|
|
|
|
REM Let the user know whether the fix was applied or not
|
|
ECHO.
|
|
IF %_FIXED% EQU true (
|
|
ECHO Success! TLS 1.2 has been enabled, please restart this device for the change to take effect.
|
|
) ELSE (
|
|
ECHO Something went wrong and TLS 1.2 is not enabled on this device.
|
|
) |