PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Disable TLS 1.0 and 1.1 via GPO

projectblack.io | research | #windows-server | #tls | #hardening | #gpo | #schannel
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Disabling TLS 1.0/1.1 (and Triple DES) on Windows via GPO: set the SCHANNEL protocol Enabled DWORDs to 0. The post notes this is server-side only and doesn't restrict outbound client connections.
Published
Collected

Related coverage

blog · semperis.com
What Should You Install on Your Domain Controllers?
A domain controller should do one thing: control the domain. Why ADDS belongs on a DC and which roles, tools, and apps to keep off it to shrink the attack surface.
blog · semperis.com
Understanding the Risks of Pre-Windows 2000 Compatible Access Settings
The legacy Pre-Windows 2000 Compatible Access group, still shipped with Windows Server 2022/2025, can leave AD wide open when it includes Authenticated Users. Traces its history and safe removal.
blog · semperis.com
AD Security 101: Lock Down Risky User Rights
User rights assigned via GPOs—debug programs, back up files, take ownership, and more—become risky when misassigned. Explains how to review and lock down dangerous user rights in Active Directory.
blog · semperis.com
AD Security 101: GPO Logon Script Security
GPO logon scripts automate logon tasks, but sprawling, poorly maintained GPO structures invite abuse. Covers how scripts work (scripts.ini) and how to secure them.
blog · semperis.com
AD Security 101: Domain Controller Security
DC security essentials: promotion changes a server's logon model and access must be tightly restricted. GPOs linked to the Domain Controllers OU affect all DCs, so mistakes are high-impact.
research · projectblack.io
Password Policy GPO
After cracking ~40% of passwords in AD environments, the post recommends disabling forced expiry (max age 0), raising minimum length toward 16, and passphrase training — cutting crack rates to ~5%.
Back