Test-TLSRegistrySettings.ps1

function Test-TLSRegistrySettings () {

# constants

# registry paths
$ZerServerPath = 'HKLM:\System\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server'
$OneClientPath = 'HKLM:\System\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Client'
$OneServerPath = 'HKLM:\System\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server'
$CipherPath    = 'HKLM:\System\CurrentControlSet\Control\Cryptography\Configuration\Local\SSL\00010002'

# we want the various "Enabled" entries to have Data of 0
$DesiredEnabled = 0
# we want the various "DisabledByDefault" entries to have Data of 1
$DesiredDisabled = 1

# desired value for ...\SSL\00010002\Functions
$DesiredCiphers = @(
'TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384',
'TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256',
'TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384',
'TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256',
'TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA',
'TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA',
'TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384',
'TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256',
'TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384',
'TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256',
'TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA',
'TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA'
)

# blindly try to do all the things, then do various tests after
$ErrorActionPreference = 'SilentlyContinue'

# get PowerShell objects for the registry keys
$ZerServerKey = Get-Item -Path $ZerServerPath
$OneClientKey = Get-Item -Path $OneClientPath
$OneServerKey = Get-Item -Path $OneServerPath
$CipherKey    = Get-Item -Path $CipherKey

# get PowerShell objects for the registry entries

$ZerServerEnabled  = $ZerServerKey | Get-ItemProperty -Name 'Enabled'

$OneClientDisabled = $OneClientKey | Get-ItemProperty -Name 'DisabledByDefault'
$OneClientEnabled  = $OneClientKey | Get-ItemProperty -Name 'Enabled'

$OneServerDisabled = $OneServerKey | Get-ItemProperty -Name 'DisabledByDefault'
$OneServerEnabled  = $OneServerKey | Get-ItemProperty -Name 'Enabled'

$CipherFuncs       = $CipherKey    | Get-ItemProperty -Name 'Functions'

# restore normal error behavior and move on to our tests
$ErrorActionPreference = 'Continue'

# do the registry key exist at all?
if (-not (Test-Path $ZerServerPath)) { return 'TLS 1.0 Server path missing' }
if (-not (Test-Path $OneClientPath)) { return 'TLS 1.1 Client path missing' }
if (-not (Test-Path $CipherPath   )) { return 'TLS cipher suite path missing' }

# did we get objects for the registry keys?
if ($null -eq $ZerServerKey)      { return 'TLS 1.0 Server key issue' }
if ($null -eq $OneClientKey)      { return 'TLS 1.1 Client key issue' }
if ($null -eq $OneServerKey)      { return 'TLS 1.1 Server key issue' }

# did we get objects for the registry entries?
if ($null -eq $ZerServerEnabled)  { return 'TLS 1.0 Server property Enabled issue' }
if ($null -eq $OneClientDisabled) { return 'TLS 1.1 Client property DisabledByDefault issue' }
if ($null -eq $OneClientEnabled)  { return 'TLS 1.1 Client property Enabled issue' }
if ($null -eq $OneServerDisabled) { return 'TLS 1.1 Server property DisabledByDefault issue' }
if ($null -eq $OneServerEnabled)  { return 'TLS 1.1 Server property Enabled issue' }
if ($null -eq $CipherFuncs)       { return 'TLS cipher suite property Functions issue' }

# do the DWORDs have the desired values?
if ($ZerServerEnabled  -ne $DesiredEnabled) { return 'TLS 1.0 Server property Enabled does not have desired value' }
if ($OneClientEnabled  -ne $DesiredEnabled) { return 'TLS 1.1 Client property Enabled does not have desired value' }
if ($OneServerEnabled  -ne $DesiredEnabled) { return 'TLS 1.1 Server property Enabled does not have desired value' }
if ($OneClientDisabled -ne $DesiredDisabled) { return 'TLS 1.1 Client property DisabledByDefault does not have desired value' }
if ($OneServerDisabled -ne $DesiredDisabled) { return 'TLS 1.1 Server property DisabledByDefault does not have desired value' }

# Compare-Object returns TRUE if params DIFFER
if (Compare-Object $CipherFuncs $DesiredCiphers) { return 'TLS cipher suite Functions property does not have desired value' }

# all the checks passed
return $true

}