crosse/schannelgrouppolicy

Group Policy Template for Schannel

Group Policy Template for Schannel

Maintainers Wanted!

I no longer maintain Windows servers for my job, so this may be out of date. If you notice something that needs to be updated, please submit an issue or a pull request! I can only rely on others to keep this project relevant and updated, and if you'd like to help out (and have a Windows environment in which you could test pull requests!), let me know and I can add you to this repo. Thanks!

What Is This?

I really like Nartac Software's IIS Crypto tool for configuring protocols, ciphers, hashes and key exchange algorithms on Windows. However, since the tool simply makes changes to the local machine's registry it still requires a bit of work if you want to roll out these changes to multiple machines. Sure, you could use IIS Crypto on a single machine, export the registry keys, then import them via a startup script GPO, but I wanted a more Group Policy-integrated way to enable or disable things. So I created an administrative template for Group Policy to do just that.

What Does it Do?

This template simply twiddles values under the registry key HKLM\CurrentControlSet\Control\SecurityProviders\Schannel.

Note that since that key does not reside under the Policies key, using this template will "tattoo" the settings onto the registry. In other words, removing the policy will not revert these settings to their previous values.

Installation

From MSDN's Managing Group Policy ADMX Files Step-by-Step Guide, there are two ways to install custom administrative templates.

Local Installation

• Copy the language-neutral ADMX file(s) to %SYSTEMROOT%\PolicyDefinitions.
• Copy the language-specific ADML file(s) to %SYSTEMROOT%\PolicyDefinitions\[MUIculture] (for example, the U.S. English ADMX language specific file will be stored in %SYSTEMROOT%\policyDefinitions\en-us.)

You will then be able to use the template on your local workstation to create and edit local or domain policies, but the template will not be available to other administrators. A better option is to install the template files in the domain's central store.

Installation in the Central Store

To make the template available automatically to all Group Policy administrators in a domain, perform the following on a domain controller:

• Copy the language-neutral ADMX file(s) to %SYSTEMROOT%\sysvol\domain\policies\PolicyDefinitions.
• Copy the language-specific ADML file(s) to %SYSTEMROOT%\sysvol\domain\policies\PolicyDefinitions\[MUIculture] (for example, the U.S. English ADMX language specific file will be stored in %SYSTEMROOT%\sysvol\domain\policies\PolicyDefinitions\en-us.)

Usage

The new policy settings are located in the same place one would normally configure the SSL Cipher Suite order; namely:

Computer Configuration/Administrative Templates/Network/SSL Configuration

Screenshot:

Available Policy Settings

Any of the following ciphers, hash algorithms, or key exchange algorithms can be enabled or disabled globally. The protocols can be independently configured for both client and server use. Note that changes to the ciphers and hashes (and presumably, to the key exchange algorithms) will take effect immediately when the group policy is applied. Changes to protocols require a restart of the computer.

Ciphers

• AES 128/128
• AES 256/256

Ciphers\Weak Ciphers

• NULL
• DES 56/56
• RC2 40/128
• RC2 56/128
• RC2 128/128
• RC4 40/128
• RC4 56/128
• RC4 64/128
• RC4 128/128
• Triple DES 168

Hash Algorithms

• SHA-256
• SHA-384
• SHA-512

Hash Algorithms\Weak Hash Algorithms

• MD5
• SHA (also called "SHA-1")

Key Exchange Algorithms

• PKCS
• Elliptic-Curve Diffie-Hellman (ECDH)

Key Exchange Algorithms\Weak Key Exchange Algorithms

• Diffie-Hellman (DH)

Protocols

• TLS 1.3
• TLS 1.2
• DTLS 1.2
• DTLS 1.0

Protocols\Weak Protocols

• Multi-Protocol Unified Hello
• PCT 1.0
• SSL 2.0
• SSL 3.0
• TLS 1.0
• TLS 1.1

Cipher Suite Order

Setting the cipher suite order (the second half of IIS Crypto) for Windows involves configuring a Microsoft-delivered group policy setting. See Prioritizing Schannel Cipher Suites for more information. (Note this line on that page, however: "The list of cipher suites is limited to 1023 characters." So you can't go nuts with this GPO like you can if you set the registry key outright, but the GPO is certainly easier to deploy.) There are a few ways you can build your cipher suite list.

• Use IIS Crypto as a guide. Start the tool, click the "Best Practices" button, and copy down what it gives you.
• Use Steve Gibson's list. Just copy that list, remove the line breaks, and paste it into the GPO setting.
• Roll your own.

Once you've got your list, add it to your GPO and roll it out!

Resources

• SSL Labs' SSL/TLS Deployment Best Practices
• TLS Cipher Suites in Windows Server 2003 and XP
• SSL Cipher Suites in Windows Server 2003 and XP
• Schannel Cipher Suites in Windows Server 2008 and Vista
• Schannel Cipher Suites in Windows Server 2008 R2 and above
• Microsoft TLS 1.3 Support Reference
• How to restrict the use of certain cryptographic algorithms and protocols in Schannel.dll
• Managing Group Policy ADMX Files Step-by-Step Guide
• Transport Layer Security (TLS) registry settings
• Transport Layer Security (TLS) best practices with .NET Framework

schannelgrouppolicy's Issues

Setting the TLS 1.1 and 1.2 setting creates a "Default" registry key DWORD of 1.

After using this in my lab, and then in production, we noticed after setting TLS 1.1 and 1.2 to enabled, that the "Default" registry key for Client and Server sub-sections was changed from a string to a DWORD type, and set to the value of 1. For example:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server]
"Enabled"=dword:00000001
"DisabledByDefault"=dword:00000000
@=dword:00000001

Any idea how/why the Default value for these keys is having it's type modified and/or being set to 1? I have looked at your XML and can't see anything that jumps out at me as to why.

Thank you for your time putting this together BTW!

[BUG] When enabling TLS 1.2 and TLS 1.3 in the GPO the TLS 1.2 or TLS 1.3 (and weak protocols) settings disappears from the GP result

When enabling TLS 1.3 in the GPO the TLS 1.2 settings disappear from the gpresult page in the Group Policy Management sometimes.
It looks like the settings are not being rendered.
After editing the GPO settings a few times the TLS 1.2 settings appear again. But after refreshing the settings page of the GPO the settings disappear again...

And after refreshing a few times the setting appear again...

Seems like a weird bug...

Incorrect registry key for "Triple DES 168"

The registry key you set for "Triple DES 168" is "Triple DES 168/168." However, as per official Microsoft support article (https://support.microsoft.com/help/245030), this key name only applies to legacy (pre-Windows Vista) operating system. For modern OSes, the name of the key should be just "Triple DES 168"--i.e., without the tailing "/168."

Only enable TLS 1.3 for Windows 10 1903

As per @JonathanPitre: for TLS 1.3, this needs to be fixed from

SUPPORTED_Windows_10_0 (line 392)
to
SUPPORTED_Windows_10_0_RS6_NOSERVER

so it's only enable on Windows 10 1903. There's no such thing as Windows Server 2019 1903 (with GUI at least)

Originally posted by @JonathanPitre in #14 (comment)

presentation missing for TLSv13 on ADML

Enable Client-side TLS 1.3 (eg., Internet Explorer) Enable Server-side TLS 1.3 (eg., IIS)

Empty options

Hi,

Thanks for providing these templates!
I have installed the templates on my lab DC. When I configure a GPO, both settings (".NET Framework 2 STrong Crypto" and ".NET Framework 4 Strong Crypto") shows under "SSL Configuration Settings". However, when I open the setting, the "options window" is empty.
My DC is Windows Server 2019 (schema version 88). Did anyone try these templates on a Windows Server 2019 Domain Controller?

Move DTLS 1.0 in Weak Protocols ?

Hi,

Just wondering why DTLS 1.0 is not shown under the "Weak Protocols" section, since it is based on TLS 1.1, which is considered weak in the template ?

If it's a bug, would be happy to open a PR to fix it, just let me know !

Broken link to Cipher Suite Order on README.md

README.md contains several suggestions for "Cipher Suite Order." One of them is entitled as "Steve Gibson's list." However, the link goes to Microsoft website (https://msdn.microsoft.com/library/windows/desktop/bb870930)--which, I assume, is not what you intended.

The link should be important, because other suggestion (Use IIS Crypto as a guide) is not terribly actionable. Unfortunately, you cannot copy the names from the tool, and re-typing them seems too error-prone.

Add link to TLS 1.3 to the README

Suggestion: "SchUseStrongCrypto" for .NET Framework

Apparently, .NET Framework starts to experience issues once TLS 1.0 is disabled and only TLS 1.1 and 1.2 are left enabled. (Here's one example explained in details: https://blogs.technet.microsoft.com/keithab/2015/06/22/error-while-configuring-wapthe-underlying-connection-was-closedpart-2/. However, there are other apps as well known to experience similar problems, e.g. Azure Backup agent.)

This can be mitigated with "SchUseStrongCrypto" value in registry. It should be set up twice (for x64 and x86 versions of .NET Framework), and separately for .NET Framework 2.x/3.x family, and for .NET Framework 4.x, which makes four areas total. (See https://technet.microsoft.com/library/security/2960358 for details.)

I propose you add respective settings to your awesome ADMX templates. So that people who disable TLS 1.0 using Group Policy, could also enable "SchUseStrongCrypto" using the same policy, and avoid issues. I doubt you can set multiple registry properties using the same setting, so you might end up adding four different settings (2.x-x86, 2.x-x64, 4.x-x86 and 4.x-x64.) That would be fine.

Thanks in advance!

Add TLS 1.3 support for Windows 10 1903

To enable TLS v1.3 in either of these versions of Windows you should import the following registry file into your registry:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.3\Client]
“DisabledByDefault”=dword:00000000
“Enabled”=dword:00000001

Sources:
https://devblogs.microsoft.com/premier-developer/microsoft-tls-1-3-support-reference/#:~:text=TLS%2F1.3%20is%20supported%20in,based%20browsers%20support%20TLS%201.3.&text=Will%20TLS%201.3%20be%20supported%20in%20Windows%2010%20and%20Server%3F