Skip to content

Commit 532b84f

Browse files
FabianNiesenFabianNiesen
committed
Initial version from staging
1 parent 54f1013 commit 532b84f

1 file changed

Lines changed: 184 additions & 0 deletions

File tree

‎ActiveDirectory/set-BSI-TR-02102-2.ps1‎

Lines changed: 184 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,184 @@
1+
#requires -version 5.1
2+
#requires -module GroupPolicy
3+
4+
<#
5+
.SYNOPSIS
6+
Configures Windows Server security settings to comply with the BSI TR-02102-2 guideline (2025), focusing on cryptographic protocols, cipher suites, key lengths, and elliptic curves. The script disables insecure protocols (e.g., SSL 2.0, SSL 3.0, TLS 1.0, TLS 1.1), enables secure ones (TLS 1.2, TLS 1.3), and adjusts registry and Group Policy settings to enhance security. It is primarily designed for domain controllers but can be applied to other servers after compatibility testing.
7+
8+
.DESCRIPTION
9+
The PowerShell script set-BSI-TR-02102-2.ps1 is designed to configure Windows Server security settings in compliance with the BSI TR-02102-2 "Cryptographic Mechanisms: Recommandations and Key Lengths: Use of Transport Layer Security (TLS)" Version: 2025-1 technical guideline. It focuses on securing cryptographic protocols, cipher suites, key lengths, and elliptic curves to meet IT baseline protection measures. The script primarily targets domain controllers but can also be applied to other servers, provided compatibility is ensured.
10+
11+
The script disables insecure protocols such as SSL 2.0, SSL 3.0, TLS 1.0, and TLS 1.1 while enabling and configuring TLS 1.2 and TLS 1.3 as recommended. It also deactivates weak ciphers like Triple DES (due to the SWEET32 vulnerability) and hash algorithms such as MD5 and SHA. Recommended ciphers, including AES 128/256 and TLS 1.2/1.3-compliant cipher suites, are enabled. Additionally, elliptic curves like brainpoolP256r1, brainpoolP384r1, and brainpoolP512r1 are activated, while NIST curves (e.g., NistP256, NistP384) are disabled, except for curve25519, which remains active for compatibility.
12+
13+
Key lengths for Diffie-Hellman and RSA are increased to a minimum of 3000 bits, aligning with the guideline's requirements. The script also enforces strong cryptography for .NET Framework by enabling the SchUseStrongCrypto setting. It applies these changes via Group Policy (Set-GPRegistryValue) and registry modifications, ensuring centralized management across domain controllers.
14+
15+
While the script addresses key recommendations from Chapter 3 of the BSI TR-02102-2, it does not cover all aspects, such as quantum-safe algorithms or advanced key management. It includes disclaimers and emphasizes the need for thorough testing in a controlled environment before deployment. Compatibility with third-party systems like VMware, NAS devices, and appliances should also be verified, as these may not support the latest TLS versions or cipher suites.
16+
17+
In summary, this script provides a robust foundation for implementing BSI TR-02102-2 recommendations on Windows Servers. However, it requires careful validation, testing, and adaptation to the specific needs of the environment. It is intended for educational purposes and should not be used in production without proper evaluation and backup measures.
18+
19+
DISCLAIMER
20+
This script is provided "as is" without any warranty of any kind, express or implied, including but not limited to the warranties of merchantability, fitness for a particular purpose, and noninfringement.
21+
Use of this script is at your own risk. The author assumes no responsibility for any damage or data loss caused by the use of this script.
22+
This Script may cause your system to be no longer able to logon to your Domain.
23+
It is strongly recommended to test this script in a controlled environment before deploying it to production systems.
24+
Ensure you have proper backups and a rollback plan in place before applying any changes.
25+
Verify that your Domain Controller, Kerberos and all other Windows certificates are compatible with the settings applied by this script.
26+
Compatibility with third-party systems, applications, or devices is not guaranteed and must be verified by the user.
27+
28+
.PARAMETER DCgpoName
29+
Specifies the name of the Group Policy Object (GPO) to be created or updated. This GPO will contain the security settings defined by the script.
30+
Default: 'BSI-TR-02102-2'
31+
32+
.PARAMETER 2026support
33+
Specifies whether to enable support for cryptographic algorithms and settings that are only recommended until 2026. This setting was required in my Testdomain to maintain compatibility with AD logon.
34+
Acceptable values: 0 (disable), 1 (enable)
35+
Default: 0
36+
37+
.EXAMPLE
38+
.\set-BSI-TR-02102-2.ps1 -DCgpoName "BSI-TR-02102-2" -support2026 1
39+
This example creates or updates a GPO named "BSI-TR-02102-2" and enables support for cryptographic settings recommended until 2026.
40+
41+
.EXAMPLE
42+
.\set-BSI-TR-02102-2.ps1 -DCgpoName "BSI-TR-02102-2"
43+
This example creates or updates a GPO named "BSI-TR-02102-2" without enabling settings recommended only until 2026.
44+
45+
.NOTES
46+
Author : Fabian Niesen
47+
Filename : set-BSI-TR-02102-2.ps1
48+
Requires : PowerShell Version 5.1, Windows Server 2022 oder 2025, GPMC installed
49+
Version : 0.1
50+
History : 0.1 FN 26.04.2026 initial version
51+
52+
.LINK
53+
Blog DE: folgt bei Gelegenheit - https://www.infrastrukturhelden.de/
54+
Blog EN: comming soon - https://www.infrastructureheroes.org
55+
BSI-TR-02102-2 EN: https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/TechGuidelines/TG02102/BSI-TR-02102-2.html
56+
BSI-TR-02102-2 DE: https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Publikationen/TechnischeRichtlinien/TR02102/BSI-TR-02102-2.html
57+
Script: https://github.com/InfrastructureHeroes/Scipts/blob/master/ActiveDirectory/set-BSI-TR-02102-2.ps1
58+
#>
59+
[cmdletbinding()]
60+
Param(
61+
[Parameter(Mandatory=$false)][string]$DCgpoName = 'BSI-TR-02102-2',
62+
[Parameter(Mandatory=$false)][ValidateSet(0, 1)][int]$support2026 = 1
63+
)
64+
Write-Host "DISCLAIMER:" -ForegroundColor Yellow
65+
Write-Host "This script is provided 'as is' without any warranty of any kind, express or implied, including but not limited to the warranties of merchantability, fitness for a particular purpose, and noninfringement." -ForegroundColor Yellow
66+
Write-Host "Use of this script is at your own risk. The author assumes no responsibility for any damage or data loss caused by the use of this script." -ForegroundColor Yellow
67+
Write-Host "This Script may cause your system to be no longer able to logon to your Domain." -ForegroundColor Yellow
68+
Write-Host "It is strongly recommended to test this script in a controlled environment before deploying it to production systems." -ForegroundColor Yellow
69+
Write-Host "Ensure you have proper backups and a rollback plan in place before applying any changes." -ForegroundColor Yellow
70+
Write-Host "Verify that your Domain Controller, Kerberos and all other Windows certificates are compatible with the settings applied by this script." -ForegroundColor Yellow
71+
Write-Host "Compatibility with third-party systems, applications, or devices is not guaranteed and must be verified by the user." -ForegroundColor Yellow
72+
$consent = Read-Host "Do you agree to proceed? Type 'Y' to continue or any other key to exit"
73+
if ($consent -ne 'Y') { Write-Host "You did not agree to the disclaimer. Exiting script." -ForegroundColor Red ; exit }
74+
75+
Write-Output "Create GPO for BSI-TR-02102-2: $DCgpoName"
76+
Try { New-GPO -Name $DCgpoName -Comment 'Please check https:// for more information' -ErrorAction Stop } Catch { Write-Host 'GPO already exists' -ForegroundColor Yellow }
77+
78+
Write-Output "Set BSI-TR-02102-2 settings in GPO: $DCgpoName"
79+
80+
Set-GPRegistryValue -Name $DCgpoName -Key 'HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\PCT 1.0\Server' -ValueName Enabled -Value 0 -Type DWord | Out-Null
81+
Set-GPRegistryValue -Name $DCgpoName -Key 'HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\PCT 1.0\Client' -ValueName Enabled -Value 0 -Type DWord | Out-Null
82+
# Disable TLS 1.0 for SChannel (BSI-TR-02102-2 Chapter 3.2)
83+
Set-GPRegistryValue -Name $DCgpoName -Key 'HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server' -ValueName Enabled -Value 0 -Type DWord | Out-Null
84+
Set-GPRegistryValue -Name $DCgpoName -Key 'HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Client' -ValueName Enabled -Value 0 -Type DWord | Out-Null
85+
86+
# Disable TLS 1.1 for SChannel (BSI-TR-02102-2 Chapter 3.2)
87+
Set-GPRegistryValue -Name $DCgpoName -Key 'HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server' -ValueName Enabled -Value 0 -Type DWord | Out-Null
88+
Set-GPRegistryValue -Name $DCgpoName -Key 'HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Client' -ValueName Enabled -Value 0 -Type DWord | Out-Null
89+
90+
# SSL2 is not recomended (BSI-TR-02102-2 Chapter 3.2)
91+
Set-GPRegistryValue -Name $DCgpoName -Key 'HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Server' -ValueName Enabled -Value 0 -Type DWord | Out-Null
92+
Set-GPRegistryValue -Name $DCgpoName -Key 'HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Client' -ValueName Enabled -Value 0 -Type DWord | Out-Null
93+
94+
# SSL3 is not recomended (BSI-TR-02102-2 Chapter 3.2)
95+
Set-GPRegistryValue -Name $DCgpoName -Key 'HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server' -ValueName Enabled -Value 0 -Type DWord | Out-Null
96+
Set-GPRegistryValue -Name $DCgpoName -Key 'HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Client' -ValueName Enabled -Value 0 -Type DWord | Out-Null
97+
98+
# TLS 1.2 is recommended
99+
Set-GPRegistryValue -Name $DCgpoName -Key 'HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server' -ValueName Enabled -Value 1 -Type DWord | Out-Null
100+
Set-GPRegistryValue -Name $DCgpoName -Key 'HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server' -ValueName DisabledByDefault -Value 0 -Type DWord | Out-Null
101+
Set-GPRegistryValue -Name $DCgpoName -Key 'HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client' -ValueName Enabled -Value 1 -Type DWord | Out-Null
102+
Set-GPRegistryValue -Name $DCgpoName -Key 'HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client' -ValueName DisabledByDefault -Value 0 -Type DWord | Out-Null
103+
104+
# TLS 1.3 is recommended
105+
Set-GPRegistryValue -Name $DCgpoName -Key 'HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.3\Server' -ValueName Enabled -Value 1 -Type DWord | Out-Null
106+
Set-GPRegistryValue -Name $DCgpoName -Key 'HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.3\Server' -ValueName DisabledByDefault -Value 0 -Type DWord | Out-Null
107+
Set-GPRegistryValue -Name $DCgpoName -Key 'HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.3\Client' -ValueName Enabled -Value 1 -Type DWord | Out-Null
108+
Set-GPRegistryValue -Name $DCgpoName -Key 'HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.3\Client' -ValueName DisabledByDefault -Value 0 -Type DWord | Out-Null
109+
110+
# 3DES is not recommended (SWEET32 vulnerability)
111+
Set-GPRegistryValue -Name $DCgpoName -Key 'HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\Triple DES 168' -ValueName Enabled -Value 0 -Type DWord | Out-Null
112+
113+
# Older Ciphers
114+
Set-GPRegistryValue -Name $DCgpoName -Key 'HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\DES 56' -ValueName Enabled -Value 0 -Type DWord | Out-Null
115+
Set-GPRegistryValue -Name $DCgpoName -Key 'HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\NULL' -ValueName Enabled -Value 0 -Type DWord | Out-Null
116+
Set-GPRegistryValue -Name $DCgpoName -Key 'HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC2 40/128' -ValueName Enabled -Value 0 -Type DWord | Out-Null
117+
Set-GPRegistryValue -Name $DCgpoName -Key 'HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC2 56/128' -ValueName Enabled -Value 0 -Type DWord | Out-Null
118+
Set-GPRegistryValue -Name $DCgpoName -Key 'HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC2 128/128' -ValueName Enabled -Value 0 -Type DWord | Out-Null
119+
Set-GPRegistryValue -Name $DCgpoName -Key 'HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 40/128' -ValueName Enabled -Value 0 -Type DWord | Out-Null
120+
Set-GPRegistryValue -Name $DCgpoName -Key 'HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 56/128' -ValueName Enabled -Value 0 -Type DWord | Out-Null
121+
Set-GPRegistryValue -Name $DCgpoName -Key 'HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 128/128' -ValueName Enabled -Value 0 -Type DWord | Out-Null
122+
Set-GPRegistryValue -Name $DCgpoName -Key 'HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 64/128' -ValueName Enabled -Value 0 -Type DWord | Out-Null
123+
124+
125+
# AES128 is recommended (BSI-TR-02102-2 Chapter 3.3.1 and 3.4.4)
126+
Set-GPRegistryValue -Name $DCgpoName -Key 'HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\AES 128/128' -ValueName Enabled -Value 1 -Type DWord | Out-Null
127+
128+
# AES256 is recommended (BSI-TR-02102-2 Chapter 3.3.1 and 3.4.4)
129+
Set-GPRegistryValue -Name $DCgpoName -Key 'HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\AES 256/256' -ValueName Enabled -Value 1 -Type DWord | Out-Null
130+
131+
# SHA Hash is not recommended (BSI-TR-02102-2 Chapter 3.3.3)
132+
Set-GPRegistryValue -Name $DCgpoName -Key 'HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Hashes\SHA' -ValueName Enabled -Value 0 -Type DWord | Out-Null
133+
Set-GPRegistryValue -Name $DCgpoName -Key 'HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Hashes\SHA256' -ValueName Enabled -Value 1 -Type DWord | Out-Null
134+
Set-GPRegistryValue -Name $DCgpoName -Key 'HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Hashes\SHA384' -ValueName Enabled -Value 1 -Type DWord | Out-Null
135+
136+
# MD5 Hash is not recommended (BSI-TR-02102-2 Chapter 3.3.3)
137+
Set-GPRegistryValue -Name $DCgpoName -Key 'HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Hashes\MD5' -ValueName Enabled -Value 0 -Type DWord | Out-Null
138+
139+
# ECDH Key Exchange is recommended till 2026 for TLS 1.2 (BSI-TR-02102-2 Chapter 3.3.1.2)
140+
Set-GPRegistryValue -Name $DCgpoName -Key 'HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\KeyExchangeAlgorithms\Diffie-Hellman' -ValueName Enabled -Value $support2026 -Type DWord | Out-Null
141+
142+
# ECDH Key Exchange is recommended till 2026 for TLS 1.2 (BSI-TR-02102-2 Chapter 3.3.1.2)
143+
Set-GPRegistryValue -Name $DCgpoName -Key 'HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\KeyExchangeAlgorithms\ECDH' -ValueName Enabled -Value $support2026 -Type DWord | Out-Null
144+
145+
# RSA / PKCS Key Exchange is recommended till 2026 for TLS 1.2 (BSI-TR-02102-2 Chapter 3.3.3) #
146+
Set-GPRegistryValue -Name $DCgpoName -Key 'HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\KeyExchangeAlgorithms\PKCS' -ValueName Enabled -Value $support2026 | Out-Null
147+
148+
# TLS 1.2 Chiphers (BSI-TR-02102-2 Chapter 3.3.4)
149+
$Chiphersuites = "TLS_AES_256_GCM_SHA384,TLS_AES_128_GCM_SHA256,TLS_AES_128_CCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,TLS_DHE_RSA_WITH_AES_256_GCM_SHA384,TLS_DHE_RSA_WITH_AES_128_GCM_SHA256"
150+
#Set SSL Chiphers (Inkl. bis 2026 Zugelassene Chiphersuiten)
151+
IF ( $support2026 -eq 1) {
152+
$chiphersuites += ",TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_AES_256_CBC_SHA384,TLS_RSA_WITH_AES_128_CBC_SHA256,TLS_PSK_WITH_AES_256_GCM_SHA384,TLS_PSK_WITH_AES_128_GCM_SHA256,TLS_PSK_WITH_AES_256_CBC_SHA384,TLS_PSK_WITH_AES_128_CBC_SHA256"
153+
Write-Output "2026support is enabled - Chiphersuites for 2026 are included"
154+
}
155+
Set-GPRegistryValue -Name $DCgpoName -Key 'HKLM\Software\Policies\Microsoft\Cryptography\Configuration\SSL\00010002' -Type String -ValueName "Functions" -Value $Chiphersuites | Out-Null
156+
157+
#ECC Curven
158+
$ECCCurves = "brainpoolP512r1","brainpoolP384r1","brainpoolP256r1","curve25519"
159+
Set-GPRegistryValue -Name $DCgpoName -Key 'HKLM\Software\Policies\Microsoft\Cryptography\Configuration\SSL\00010002' -ValueName 'EccCurves' -Value $ECCCurves -Type MultiString | Out-Null
160+
161+
#Schlüssellänge für Diffie-Hellman und RSA (BSI-TR-02102-2 Chapter 3.6.1)
162+
Set-GPRegistryValue -Name $DCgpoName -Key 'HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\KeyExchangeAlgorithms\Diffie-Hellman' -ValueName ClientMinKeyBitLength -Value 0xBB8 -Type DWord | Out-Null
163+
Set-GPRegistryValue -Name $DCgpoName -Key 'HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\KeyExchangeAlgorithms\PKCS' -ValueName ClientMinKeyBitLength -Value 0xBB8 -Type DWord | Out-Null
164+
165+
#Stron Crypto für .Net
166+
Set-GPRegistryValue -Name $DCgpoName -Key 'HKLM\SOFTWARE\Microsoft\.NetFramework\v4.0.30319' -Valuename 'SchUseStrongCrypto' -value 1 -Type DWord | Out-Null
167+
Set-GPRegistryValue -Name $DCgpoName -Key 'HKLM\SOFTWARE\WOW6432Node\Microsoft\.NetFramework\v4.0.30319' -Valuename 'SchUseStrongCrypto' -value 1 -Type DWord | Out-Null
168+
Set-GPRegistryValue -Name $DCgpoName -Key 'HKLM\SOFTWARE\Microsoft\.NetFramework\v4.0.30319' -Valuename 'SystemDefaultTlsVersions' -value 1 -Type DWord | Out-Null
169+
Set-GPRegistryValue -Name $DCgpoName -Key 'HKLM\SOFTWARE\WOW6432Node\Microsoft\.NetFramework\v4.0.30319' -Valuename 'SystemDefaultTlsVersions' -value 1 -Type DWord | Out-Null
170+
Set-GPRegistryValue -Name $DCgpoName -Key 'HKLM\SOFTWARE\Microsoft\.NetFramework\v2.0.50727' -Valuename 'SchUseStrongCrypto' -value 1 -Type DWord | Out-Null
171+
Set-GPRegistryValue -Name $DCgpoName -Key 'HKLM\SOFTWARE\WOW6432Node\Microsoft\.NetFramework\v2.0.50727' -Valuename 'SchUseStrongCrypto' -value 1 -Type DWord | Out-Null
172+
Set-GPRegistryValue -Name $DCgpoName -Key 'HKLM\SOFTWARE\Microsoft\.NetFramework\v2.0.50727' -Valuename 'SystemDefaultTlsVersions' -value 1 -Type DWord | Out-Null
173+
Set-GPRegistryValue -Name $DCgpoName -Key 'HKLM\SOFTWARE\WOW6432Node\Microsoft\.NetFramework\v2.0.50727' -Valuename 'SystemDefaultTlsVersions' -value 1 -Type DWord | Out-Null
174+
175+
176+
#WinRm
177+
Set-GPRegistryValue -Name $DCgpoName -Key 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\WinHttp' -ValueName DefaultSecureProtocols -Value 0x2800 -Type DWord | Out-Null
178+
Set-GPRegistryValue -Name $DCgpoName -Key 'HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\WinHttp' -ValueName DefaultSecureProtocols -Value 0x2800 -Type DWord | Out-Null
179+
180+
#WinINET
181+
Set-GPRegistryValue -Name $DCgpoName -Key 'HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings' -ValueName SecureProtocols -Value 0x2800 -Type DWord | Out-Null
182+
183+
Write-Output "GPO $DCgpoName created and settings applied."
184+
Write-Output "Please link the GPO to the desired OU or domain."

0 commit comments

Comments
 (0)