Microsoft Configuration Manager
General

Enable Tls 1 2 Server

In brief

The page now uses consistent .NET terminology and clearer instructions for framework support, security updates, and registry subkey updates by application and operating-system architecture.

What Intune admins need to know

Administrators can use the revised wording when reviewing TLS 1.2 configuration guidance.

This summary was assembled from the tracked documentation change. Verify important details in the full Microsoft Learn article.

Documentation change

The comparison below shows only the changed extract. Use the full-page view for complete context.

Ensure that TLS 1.2 is enabled as a protocol for SChannel at the operating system level

For the most part, protocol usage is controlled at three levels, the operating system level, the framework or platform level, and the application level. TLS 1.2 is enabled by default at the operating system level. OnceAfter you ensure that the .NET registry values are set to enable TLS 1.2 and verify the environment is properly utilizingusing TLS 1.2 on the network, you maymight want to edit the SChannel\Protocols registry key to disable the older, less secure protocols. For more information onabout disabling TLS 1.0 and 1.1, see Configuring Schannel protocols in the Windows Registry.

Update and configure the .NET Framework to support TLS 1.2

Install the .NET updates so you can enable strong cryptography. Some versions of .NET Framework might require updates to enable strong cryptography. Use these guidelines:

  • .NET Framework 4.6.2 and later supportssupport TLS 1.1 and TLS 1.2. Confirm the registry settings, but make no additional changes are required.other changes.

    Note

    Starting in version 2107, Configuration Manager requires Microsoft .NET Framework version 4.6.2 for site servers, specific site systems, clients, and the console. If possible in your environment, install the latest version of .NET version 4.8.

  • Update NET.NET Framework 4.6 and earlier versions to support TLS 1.1 and TLS 1.2. For more information, see .NET Framework versions and dependencies.

  • If you're using use .NET Framework 4.5.1 or 4.5.2 on Windows 8.1, Windows Server 2012 R2, or Windows Server 2012, it's highly recommendedMicrosoft recommends that you install the latest security updates for the .Net.NET Framework 4.5.1 and 4.5.2 to ensure TLS 1.2 can be enabled properly.

    For your reference, TLS 1.2 was first introduced into .Net.NET Framework 4.5.1 and 4.5.2 with the following hotfix rollups:

    • For Windows 8.1 and Server 2012 R2: Hotfix rollup 3099842
    • For Windows Server 2012: Hotfix rollup 3099844

Make sure to set the following registry keys on any computer that communicates across the network with a TLS 1.2-enabled system. For example, Configuration Manager clients, remote site system roles not installed on the site server, and the site server itself.

ForUpdate the following subkey values for 32-bit applications that are runningrun on 32-bit OSsoperating systems and for 64-bit applications that are runningrun on 64-bit OSs, update the following subkey values:operating systems:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v2.0.50727]
      "SchUseStrongCrypto" = dword:00000001

ForUpdate the following subkey values for 32-bit applications that are runningrun on 64-bit OSs, update the following subkey values:operating systems:

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\v2.0.50727]
Daily Intune.Admin.News

Get daily email updates

Get a concise summary of the latest Microsoft Intune updates delivered straight to your inbox.

Loading the secure signup form…