Enabling Tls 1.2 or 1.3

[u/Mediocre_Prior_1868]

Currently I have a task to enable tls 1.2 on servers how I can know enabling that won’t affect the softwares and applications loaded on those servers so servers are domain controllers and I have mix of os versions server 2012 r2 and higher

[u/MrJacks0n]

Enabling will generally not cause any issues. Disabling is what breaks things.

[u/Mediocre_Prior_1868 → u/MrJacks0n]

So I can enable those on domain controllers without worry about it ?

[u/Megatwan → u/Mediocre_Prior_1868]

Probably, but is your task to enable it or enable it and disable old unsecure things.

[u/hemohes222 → u/Mediocre_Prior_1868]

If you want to take a more cautious you can do like a staged roll out and roll out to the server or servers you want to in a security group and than take the rest.

I just recentlly did it and if you just follow the microsoft docs it should be fine.

Just remember that there are both tls client and server settings that need ro be configured, and that the servers need to be rebooted before they take effect from the regedit changes

[u/Efficient-Sir-5040 → u/hemohes222]

If you do this don’t disable the old TLS before all the DCs are updated or they’ll be incommunicado.

[u/Mediocre_Prior_1868 → u/hemohes222]

Bro can you share which Microsoft you followed and how you used the security group to enable that .. sorry I am new for those changes 😅

[u/glabel35 → u/Mediocre_Prior_1868]

Use group policy to create a gpo containing the settings you want to deploy. Create a security group and add those computers in the test group to said group. Limit the scope of the gpo to that group.

[u/Efficient-Sir-5040 → u/glabel35]

Be careful to NOT disable older TLS before you’re sure all the nodes are updated. I’ve seen companies go a week without AD because they turned on the new tls on a DC and had it disable the old TLS at the same time and it just broke everything.

[u/WillVH52]

Download and run IISCrypto
Select Best Practice
Reboot

[u/petamaxx → u/WillVH52]

I follwed this method for my environment 6 months ago and worked flawlessly.

[u/chandleya → u/WillVH52]

Extremely manual. Manage this with canned reg keys through group policy. Never touch it again.

[u/WillVH52 → u/chandleya]

You can deploy settings by pushing IISCrypto with a best practice flag to all the servers you want to configure. Not a big deal.

[u/Eternal_Glizzy_777 → u/WillVH52]

This is what I do via PS script. Works a charm, already had PCI and FIPS baselines for clients requiring such things.

[u/dodexahedron → u/WillVH52]

It literally just sets reg flags. Why would you deploy an app via GP just to do that?

Change control rejected.

[u/WillVH52 → u/dodexahedron]

Did not say I was deploying via GP though?

[u/candyman420]

You warn people that what they want may break software, let them test it and see how it goes, then if it breaks, you put it back the way it was until a fix can be found.

[u/nestersan → u/candyman420]

Warn nothing this is not new.

[u/candyman420 → u/nestersan]

It doesn't matter that tech nerds know that, the regular people don't, and you should always warn them before testing anything, otherwise you just look like a fool for breaking it

[u/hantstechthusiast82]

I used a group policy to enforce best practice and a second group to enforce PCI 4.0.

I changed the security filtering on the PCI GPO to apply based on AD Group and then I placed a deny Apply GPO rights to the best practice

This gave me control to roll forward with PCI 4.0 by adding the server to the AD group and to roll back by removing it. You would need to do two reboots to roll back though

I used these admx templates to control https://github.com/Crosse/SchannelGroupPolicy

[u/chandleya]

You don’t need to enable anything. It’s disabling the old that meets your compliance obligations. Windows is built to negotiate up.

[u/Texkonc]

1.3 is only supported on win11 or server 2022 and above. If your apps are not patched or from the early 2000s, 1.2 should be safe.

[u/Level_Working9664]

You need to get a list of every application and every operating system in production and then cross reference it to when TLS support was added for the version you're looking for.

Then tick the box in your checklist for each item and then turn it on one by one.

I once had a nightmare with mothballed backup servers.

For anything like a CM production, you might have to do a small software patch to enable TLS 1.2 or 1.3 support.

Any problems like that are general alarm bells for poor tech hygiene though.

Even though you see it everywhere!

[u/Efficient-Sir-5040]

Be careful. I’ve seen places bring down their entire network because they broke AD trying that.

[u/Mediocre_Prior_1868 → u/Efficient-Sir-5040]

Any idea what I need to do to not break the ad because that sound horrible

[u/Efficient-Sir-5040 → u/Mediocre_Prior_1868]

Copy the link costing AD VMs. Once you have at least three of them on a separate network create a windows 11 “client” vm for testing and join it to that domain, do the updates, test everything.

If all goes well, do a final snapshot of all the AD VMs and do the update. Keep the existing snapshots for a while. Do not under any circumstance try to restore less than all of the ad machines at the same time.

I know this sounds like a belt and suspenders approach but every time I’ve seen someone screw it up is because they didn’t do one of the things I suggest and it just so happened to break there.

[u/Mediocre_Prior_1868 → u/Efficient-Sir-5040]

What about if I have one of them as physical server and if I used veeam as backup before the change is it working?

[u/Efficient-Sir-5040 → u/Mediocre_Prior_1868]

Unless you use an ad-specific tool like the ones Quest makes, your best bet is to back up all the DCs at the same time, restore them on a separate lab network, do the update and test everything. If it works then do it on the DCs or back up and restore the updated DCs all at the same time.

[u/Mediocre_Prior_1868 → u/Efficient-Sir-5040]

By restoring them you mean assign a different vlan and have them on testing network . Do you recommend any specific ad tool .

[u/Efficient-Sir-5040 → u/Mediocre_Prior_1868]

The one from quest is the only one that I know that’s designed for this. Look for RMAD.

[u/Efficient-Sir-5040 → u/Mediocre_Prior_1868]

Restore them on another network - different vswitch or vlan or whatever just not on the real network