Disabling TLS 1.0

Disable the old unsupported TLS 1.0 Protocol in Windows

The remote service accepts connections encrypted using TLS 1.0. TLS 1.0 has a number of cryptographic design flaws. Modern implementations of TLS 1.0 mitigate these problems, but newer versions of TLS like 1.2 and 1.3 are designed against these flaws and should be used whenever possible.

As of March 31, 2020, Endpoints that aren’t enabled for TLS 1.2 and higher will no longer function properly with major web browsers and major vendors.

PCI DSS v3.2 requires that TLS 1.0 be disabled entirely by June 30, 2018, except for POS POI terminals (and the SSL/TLS termination points to which they connect) that can be verified as not being susceptible to any known exploits.

Registry Commands

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server" /f /v DisabledByDefault /t Reg_DWORD /d 1
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server" /f /v Enabled /t Reg_DWORD /d 0

PowerShell Script

cls
$reg = Get-Item HKLM:
$key = 'SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols'
$subkey = ("TLS 1.0")
$key = $reg.OpenSubKey($key,$true)
$key.CreateSubKey($subkey)
$reg = Get-Item HKLM:
$key = 'SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0'
$subkey = ("Server")
$key = $reg.OpenSubKey($key,$true)
$key.CreateSubKey($subkey)
#KEY1
$RegistryPath = 'HKLM:SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server'
$RegistryKey = "DisabledByDefault"
$KeyValue = 1
if ((Test-Path -Path $RegistryPath)) 
{
(New-ItemProperty -Path $RegistryPath -Name $RegistryKey -Value $KeyValue -PropertyType DWORD -Force)
}
$RegistryKey = "Enabled"
$KeyValue = 0
if ((Test-Path -Path $RegistryPath)) 
{
(New-ItemProperty -Path $RegistryPath -Name $RegistryKey -Value $KeyValue -PropertyType DWORD -Force)
}

You should test any changes before rolling these out across the enterprise