Create a new version of paste:

Windows Registry Editor Version 5.00

https://community.spiceworks.com/topic/2094481-just-how-secure-unsecure-is-tls-1-2

'Many vendors, especially credit card and shipping processors,  have already turned off TLS 1.0  and 1.1 or will do so very soon. So its a big deal right now that you figure out if your server or any applications on it will work with only TLS 1.2 turned on.'

Very strict rules here; designed for clients, workstations, standalone machines, less for servers but its possible if your clients are configured properly. If you run the windows update that depreciates sha1 it will totally change your cipher suite list so make sure you update your setup; run iiscrypto.exe to confirm; you can eliminate 3DES, RC4, and NULL, they are strictly worse than AES. And NULL is obviously not useful either when you're interested in confidentiality, there is none with this cipher. 

Make sure you do a system restore before running this just to be safe!
(update there is an awesome, script here, though uses weaker ciphers than I do: https://www.hass.de/content/setup-your-iis-ssl-perfect-forward-secrecy-and-tls-12

Windows 8 comes with 1.1-1.2 already enabled; you can harden it better with this perhaps.

Microsoft: Warning The DisabledByDefault value in the registry keys under the Protocols key does not take precedence over the grbitEnabledProtocols value that is defined in the SCHANNEL_CRED structure that contains the data for an Schannel credential. (I could not find this in windows 7 SP1 Pro)

For the Schannel.dll file to recognize any changes under the SCHANNEL registry key, you must restart the computer.

Also although windows did initially list all ciphers automatically when enabling ssl priority under group policy; copying them and trying to paste them back in to the same field resulted in only 2/3'ds of the ciphers fitting in the dialogue box, (GP 1023 character limit / bug) I was forced to add them back in to the registry key manually. Info Here: https://superuser.com/questions/759065/how-to-overcome-local-group-policy-editors-1023-character-limit I did manage to get windows working properly with the weakest ciphers removed from the list. There were schannel errors in event viewer. It does not deliniate what program or service failed. May have been internet explorer; but according to microsoft this does not matter, so log as windows functions properly, in fact it ts a sign that you are safer. Most people disable the event notifications.

These are the 6 keys I updated in my registry:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Cryptography\Configuration\SSL\00010002
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Policies\Microsoft\Cryptography\Configuration\SSL\00010002
x4 HKEY_USERS\S-1-5-21-2240875929-447784991-1091042645-1000\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{********-****-****-****-************}Machine\Software\Policies\Microsoft\Cryptography\Configuration\SSL\00010002

For the group policy objects; gotta enable ssl cipher suite order; and search the registry for the exact default string that apppears and replace.

Windows 7 Defaults:

TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P256,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P384,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA_P256,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA_P384,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA_P256,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA_P384,TLS_DHE_RSA_WITH_AES_256_GCM_SHA384,TLS_DHE_RSA_WITH_AES_128_GCM_SHA256,TLS_DHE_RSA_WITH_AES_256_CBC_SHA,TLS_DHE_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_AES_256_CBC_SHA256,TLS_RSA_WITH_AES_128_CBC_SHA256,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384_P384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256_P256,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256_P384,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384_P384,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256_P256,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256_P384,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA_P256,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA_P384,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA_P256,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA_P384,TLS_DHE_DSS_WITH_AES_256_CBC_SHA256,TLS_DHE_DSS_WITH_AES_128_CBC_SHA256,TLS_DHE_DSS_WITH_AES_256_CBC_SHA,TLS_DHE_DSS_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_3DES_EDE_CBC_SHA,TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA,TLS_RSA_WITH_RC4_128_SHA,TLS_RSA_WITH_RC4_128_MD5,TLS_RSA_WITH_NULL_SHA256,TLS_RSA_WITH_NULL_SHA,SSL_CK_RC4_128_WITH_MD5,SSL_CK_DES_192_EDE3_CBC_WITH_MD5

To use only the ciphers you want:

Run Gpedit.msc / Expand Computer Configuration -> Administrative Templates -> Network and select SSL Configuration Settings (enable it, copy the default windows list, apply gpo setting; then search your registry the exact string you copied; then import your own list via registry; this is what I successfully used (perfect forward secrecy only) and its as good as it gets:

TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384_P521,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384_P384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256_P521,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256_P384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256_P256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384_P521,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384_P384,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256_P521,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256_P384,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256_P256,TLS_DHE_RSA_WITH_AES_256_GCM_SHA384_P521,TLS_DHE_RSA_WITH_AES_256_GCM_SHA384_P384,TLS_DHE_RSA_WITH_AES_128_GCM_SHA256_P521,TLS_DHE_RSA_WITH_AES_128_GCM_SHA256_P384,TLS_DHE_RSA_WITH_AES_128_GCM_SHA256_P256,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384_P521,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384_P384,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256_P521,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256_P384,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256_P256,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P521,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P521,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P384,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA_P521,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA_P384,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA_P521,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA_P384,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA_P256,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA_P521,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA_P384,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA_P521,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA_P384,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA_P256

Check IISCrypto and you'll see it reflected there also, if you updated all the necessary registry keys.
=====================================

Enable TLS 1.2 On all .NET 2.0, 3.5, 4.5+ apps (client)

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\v2.0.50727]
"SystemDefaultTlsVersions"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\v4.0.30319]
"SystemDefaultTlsVersions"=dword:00000001

=====================================


Verify if hotfix KB3140245 is installed.

# Microsoft Security Advisory 3174644 - Updated Support for Diffie-Hellman Key Exchange
# https://docs.microsoft.com/en-us/security-updates/SecurityAdvisories/2016/3174644
#
# Microsoft is providing updated support to enable administrators to configure
# longer Diffie-Hellman ephemeral (DHE) key shares for TLS servers. The updated
# support allows administrators to increase the size of a DH modulus from the
# current default of 1024 to either 2048, 3072, or 4096.
#
# Note: All versions of Windows 10 support the new DH modulus settings and use 2048 as the DH modulus default setting

00000008	Enable SSL 2.0 by default
00000020	Enable SSL 3.0 by default
00000080	Enable TLS 1.0 by default
00000200	Enable TLS 1.1 by default
00000a00	Enable TLS 1.1 + 1.2 by default
00000800	Enable TLS 1.2 by default
00000a80        Enable TLS 1.0 + 1.1 + 1.2
00000AA0	Enable SSL 3.0 + TLS 1.0 + 1.1 + 1.2
00000AA8	Enable SSL 2.0 + 3.0 + TLS 1.0 + 1.1 + 1.2

Having problems with windows? Enable TLS 1.1 + 1.2 dword:00000a00, or TLS 1.0 + 1.1 + 1.2 dword:00000a80 

No issues at all for me using this what-so-ever:

WinHTTP 2048 Bit TLS 1.2 (client) Same as MicrosoftEasyFix51044 update; though more strict, forcing 1.2 only, not problematic. 
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\WinHttp]
"DefaultSecureProtocols"=dword:00000800

WinHTTP 2048 Bit TLS 1.2 (client)  same as the windows 7 fixit update; forcing 1.2 not problematic. may have slowed windows logon times & windows update.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\WinHttp]
"DefaultSecureProtocols"=dword:00000800

(set to 1600 for dhe 4096)
=====================================
PKCS Key Exchange 2048 Bit (Thanks to Powershell script setupiisforsslperfectforwardsecrecy_pcidss31_v110)
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\KeyExchangeAlgorithms\PKCS]
"ClientMinKeyBitLength"=dword:00000800
=====================================
Enable Stronger Minimum Elliptical Diffie-Hellman Key Exchange 2048 (my personal addition, this was not in the advanced powershell script, works great but slows windows update an possibly windows logon)
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\KeyExchangeAlgorithms\ECDH]
"ClientMinKeyBitLength"=dword:00000800
=====================================
Enable Stronger Minimum Diffie-Hellman Key exchange by Default: 2048 in ISS / CryptoAPI / Windows Update, etc
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\KeyExchangeAlgorithms\Diffie-Hellman]
"ClientMinKeyBitLength"=dword:000000800
=====================================
You might want to try switching to 000001600 for 4096 bit encryption.
=====================================

Disable Weak Ciphers 

Microsoft: "Unfortunately, there is no built-in group policy administrative template to help us this this time. The individual security protocols, ciphers, hashing algorithms, and key exchanges are all enabled on Windows by default, and to disable them requires a registry change. This change is done by adding the “Enabled” value to the associated component registry subpath that you want disabled and setting the value to “0” as illustrated below"

(a great alternative is to just use ISSCrypto.exe)

Disable Weak Ciphers In IIS, CryptoAPI & more. Some claimed it broke remote desktop access and older versions of SQL server. All of which can be fixed with the proper updates. Check out #Error Work Arounds.txt.

Schannel also deals with cryptoAPI as well, an integral part of windows update, NCSI, and Internet Explorer; so make sure you do a system restore before running this just to be sure you can fix any errors in a hurry, if you need to. Disable anything less than tls 1.2 in Internet Explorer Options -> advanced, scroll to the bottom. Internet explorer is tied into the fabric of windows itself and "Internet Options" effects cryptoapi, and certificate exchanges that take place even in Chrome and Firefox via "Check for server certificate revocation" and "check for publishers certificate revocation". So make sure IE is hardrened too.

I confirm this influences windows update; when I had improperly configured schannel ciphers, effectively disabling them, trying to enable them using dword:00000001 instead of fffffff; windows update failed to function and other schannel errors occurred; Once I had used ffffffff no schannel errors occurred enabling them, along with a strict DHE only policy.

Server apps may need upgrading, like SQL for example to versions compatible with TLS 1.2. Or just tweak your settings to more relaxed for certain standards; My way of seeing it however, is hackers may force you to use the weakest link & lowest priority in the cipher chain, so be mindfull. 

=====================================

ISS Server / Windows Update / CryptoAPI (maybe othres)

Disable Multi-Protocol Unified Hello

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\Multi-Protocol Unified Hello\Server]
"Enabled"=dword:00000000
"DisabledByDefault"=dword:00000001
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\Multi-Protocol Unified Hello\Client]
"Enabled"=dword:00000000
"DisabledByDefault"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\NULL]
"Enabled"=dword:00000000
"DisabledByDefault"=dword:00000001
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\DES 56/56]
"Enabled"=dword:00000000
"DisabledByDefault"=dword:00000001
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC2 40/128]
"Enabled"=dword:00000000
"DisabledByDefault"=dword:00000001
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC2 56/128]
"Enabled"=dword:00000000
"DisabledByDefault"=dword:00000001
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 40/128]
"Enabled"=dword:00000000
"DisabledByDefault"=dword:00000001
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 56/128]
"Enabled"=dword:00000000
"DisabledByDefault"=dword:00000001
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 64/128]
"Enabled"=dword:00000000
"DisabledByDefault"=dword:00000001
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 128/128]
"Enabled"=dword:00000000
"DisabledByDefault"=dword:00000001
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\PCT 1.0\Server]
"Enabled"=dword:00000000
"DisabledByDefault"=dword:00000001
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\PCT 1.0\Client]
"Enabled"=dword:00000000
"DisabledByDefault"=dword:00000001
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Server]
"Enabled"=dword:00000000
"DisabledByDefault"=dword:00000001 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Client]
"Enabled"=dword:00000000
"DisabledByDefault"=dword:00000001 

# NOTE for SERVERS: If you disable SSL 3.0 the you may lock out some people still using
# Windows XP with IE6/7. Without SSL 3.0 enabled, there is no protocol available
# for these people to fall back. Safer shopping certifications may require that
# you disable SSLv3.

Disable SSL 3.0 (PCI Compliance) and enable "Poodle" protection
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server]
"Enabled"=dword:00000000
"DisabledByDefault"=dword:00000001
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Client]
"Enabled"=dword:00000000
"DisabledByDefault"=dword:00000001

Disabling TLS 1.0 may cause Website errors in Internet Explorer and possibly elsewhere (you can enable 1.0+1.1 along with WinHttp above)
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server]
"Enabled"=dword:00000000
"DisabledByDefault"=dword:00000001
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Client]
"Enabled"=dword:00000000
"DisabledByDefault"=dword:00000001
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server]
"Enabled"=dword:00000000
"DisabledByDefault"=dword:00000001
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Client]
"Enabled"=dword:00000000
"DisabledByDefault"=dword:00000001

Enable Triple DES 168
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\Triple DES 168]
"Enabled"=dword:ffffffff

Enable AES 128/128
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\AES 128/128]
"Enabled"=dword:ffffffff

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\AES 128/128]

Enable AES 256/256

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\AES 256/256]
"Enabled"=dword:ffffffff

Disable MD5
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Hashes\MD5]
"Enabled"=dword:00000000
"DisabledByDefault"=dword:00000001

Enable SHA
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Hashes\SHA]
"Enabled"=dword:00000001
"DisabledByDefault"=dword:00000000

Enable 256, and 384 and 512 SHA!
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Hashes\SHA256]
"Enabled"=dword:ffffffff

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Hashes\SHA384]
"Enabled"=dword:ffffffff

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Hashes\SHA512]
"Enabled"=dword:ffffffff

Enable perfect forward secrecy + Elliptical curve
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\KeyExchangeAlgorithms\Diffie-Hellman]
"Enabled"=dword:ffffffff

Enable PKCS
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\KeyExchangeAlgorithms\PKCS]
"Enabled"=dword:ffffffff

Enable Elliptical Diffie-Hellman
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\KeyExchangeAlgorithms\ECDH]
"Enabled"=dword:ffffffff

Enable TLS 1.2!
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client]
"Enabled"=dword:ffffffff
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server]
"Enabled"=dword:ffffffff