Hi All,
We have a plan to implement TLS 1.2 in our SCOM 2012 R2 environment. Currently we are running UR13 which will soon be updated with UR14 patch level, since UR 14 is required for TLS 1.2.
SCOM Management Server are running Windows Server 2012 R2 Operating System.
We are following Kevin Holman's bolg on implementing TLS 1.2:
https://kevinholman.com/2018/05/06/implementing-tls-1-2-enforcement-with-scom/?unapproved=4158&moderation-hash=55206c62853d52307de59246f58909e6#comment-4158
Also we are checking the following blog on TLS 1.2:
https://docs.microsoft.com/en-us/windows-server/security/tls/tls-registry-settings
As per this blog to Enable or Disable TLS 1.2 or any older version of TLS we need to add Registry key under the Registry path: HKLM SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols.
So I logged into our SCOM Management Servers to see which version of TLS we are currently running and I noticed under the Registry path: HKLM SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols, we only find SSL 2.0 > Client but the
Value for DisabledByDefault is 1, so it means SSL 2.0 is disabled.
But the question is which Security protocol is currently running on our SCOM servers.
In Kevin's blog he also mentioned that after enforcing TLS 1.2, we can always switch back and enable TLS 1.0 quickly if needed, its just a registry change and reboot away. But since the registry keys are not present by default how do we do it.
![]()
Then I came accross this article where it is mentioned all the TLS versions are enabled on Windows Server 2012 R2.
So is it indeed that all the TLS version are running together, if so then do we need to use Kevin Holman's blog to Enforce TLS 1.2, since TLS 1.2 should be enabled by default. I am confused with this. Any help will be appreciated to clarify this.
https://docs.microsoft.com/en-us/windows/win32/secauthn/protocols-in-tls-ssl--schannel-ssp-![]()
Thanks,
Sreejeet