How to enforce TLS 1.2 and disable legacy encryption protocols via registry or GPO. Defend your transmitted data with stronger encryption. Here's how to enforce TLS 1.2 and disable legacy encryption using the Windows registry and Group Policy. Before we begin, be sure to subscribe to NinjaOne's IT Video Hub and our YouTube channel for more tech content like this. Why enforce TLS 1.2 and disable legacy encryption protocols? Legacy encryption protocols such as SSL 2.0, SSL 3.0, TLS 1.0, and TLS 1.1 have several vulnerabilities that compromise the security of transmitted data. Thus, enabling modern encryption protocols such as Transport Layer Security, TLS 1.2, while disabling legacy protocols, is essential for protecting transmitted data and meeting modern security standards. How enforce TLS 1.2 and disable legacy encryption protocols with registry? Administrators can enforce TLS 1.2 and disable legacy protocols through the Windows registry or Group Policy. In the Windows registry, encryption protocols can be found in: Instead of enabling and disabling protocols one by one, you can use a simpler method. Run the following script in PowerShell with administrator privileges. Then, after restarting the device to apply the changes, verify the configuration by opening Command Prompt with administrator privileges and running this command. How to enforce TLS 1.2 and disable legacy encryption protocols with GPO. In Group Policy Editor, there are no native GPO settings to enforce TLS versions, so you will need to create the necessary registry keys. To do this, open Group Policy Editor, navigate to Computer Configuration, Preferences, Windows Settings, Registry, and under this path. Optionally, administrators can also configure the SSL Cipher Suite Order policy to remove weak or outdated cipher suites for additional security hardening. How to check if TLS 1.2 is enforced and legacy encryption protocols are disabled. Once you have used either method, you should confirm that TLS 1.2 is enforced and verify that no legacy encryption protocols are still active. On PowerShell, test the TLS connection using this script. This command returns JSON output showing which TLS protocol version is being used. Next, run this script to identify .NET applications that may still reference older TLS protocols. In the Event Viewer, navigate to Windows Logs, System, and look for logs with an SChannel source. Logs with event IDs 36874 and 36888 indicate failed or downgraded attempts. Finally, in Command Prompt, run this command to check the status of the registry keys. Ensuring your systems use modern encryption standards helps protect sensitive data and strengthens overall security. For more information, check out our official blog post on how to enforce TLS 1.2 plus and disable legacy protocols via GPO or registry, linked in the description below.