Share via

How to fix Azure recomendation "Windows servers should be configured to use secure communication protocols"

Mohammadmahdi Golmohammadi 25 Reputation points
2025-08-19T15:33:22.8033333+00:00

Hi

I want to fix recomendation "Windows servers should be configured to use secure communication protocols" on Azure but the provided link in Defender for Cloud could not help me.

This the link -> https://free.blessedness.top/en-us/dotnet/framework/network-programming/tls#configuring-schannel-protocols-in-the-windows-registry

Could you please help me to undersatnd the solution? what exactly should be changed and how it can be done? Where do I need to do this?

Developer technologies | .NET | Other
0 comments
Answer accepted by question author
  1. Susmitha T (INFOSYS LIMITED) 910 Reputation points Microsoft External Staff
    2025-08-20T09:57:07.78+00:00

    Hope you are doing good! Thank you for reaching out. Please find the answer below.

    1.Manual Registry Method update: You’ll need to modify the Windows Registry to:

    • Disable insecure protocols: SSL 2.0, SSL 3.0, TLS 1.0, TLS 1.1
    • Enable secure protocols: TLS 1.2 (and optionally TLS 1.3 if supported)

    These changes are made under the Schannel settings in the Windows Registry. You can do this by following these steps:

    • Open the Registry Editor (regedit).
    • Navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Cryptography\Configuration\.
    • Check for keys related to your current protocols. You may need to create keys for TLS 1.2 if they don’t exist.
    • Here’s a reference for the necessary changes you would typically make:
      • In the Protocols branch, create keys for TLS 1.2, and within that, create keys named Client and Server. Set the DWORD values for Enabled to 1 and DisabledByDefault to 0.

     

    2. Reboot the server: After making these changes, restart your Windows server to apply the new settings.

     

    3. Verify Settings: You can verify that the changes took effect by using tools like SSL Labs or performing a manual check with PowerShell commands to see which protocols are currently active.

    SSL Labs: To check which protocols are supported.

    PowerShell commands: To see currently active protocols.

     

    4.Policy Compliance: After implementing these changes, re-evaluate your Azure policy compliance to see if it reflects positively on your security posture.

     

    If issue still persist after following all the steps, we’ll be happy to assist further if needed." Kindly mark the answer as accepted if the issue resolved".

0 additional answers

Sort by: Most helpful
Most helpful Newest Oldest

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.