We help IT Professionals succeed at work.

Setting Windows Ciphers and Cipher Suites in Windows for a large number (500+ Servers)

George R. Kasica
George R. Kasica asked
on
17 Comments
3 Solutions
1,019 Views
Last Modified: 2017-03-23
We have a large number of servers here (5-700) 2008 and 20012R2 and need to set them to PCI standards. We Can obviously use the IISCrypto tool to  do the setting on a server by server basis but to do this on the large number of remote VMs is painful at best and horribly time consuming. We were able to use registry settings to turn off SSL v3 etc. here but can't see a way to do the same thing for the Ciphers and Cipher SUites. Can anyone suggest a way to do this quickly with a reg file or such? We use a tool called KACE that could deploy or run a batch file etc. Screen capture is attached showing what we need off.
IISCrypto-DisabledCipherSuites.JPG
Comment
Watch Question

View Solutions Only

Patrick BogersDatacenter platform engineer Lindows
CERTIFIED EXPERT
Commented:
This problem has been solved!
(Unlock this solution with a 7-day Free Trial)
UNLOCK SOLUTION
aravind ancheWindows/Vmware
CERTIFIED EXPERT

Commented:
this link have some reg keys to disable RC4
http://windowsitpro.com/windows/disabling-rc4-cipher

I have a reg key to disable RC4 cipher let me check and will post it
aravind ancheWindows/Vmware
CERTIFIED EXPERT

Commented:
1. Open notepad.
2. Paste the below lines:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 128/128]
"Enabled"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 40/128]
"Enabled"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 56/128]
"Enabled"=dword:00000000

3. Click 'Save As' and select All files below and enter name 'Disable_RC4_Ciphers.reg'

please check before deploying
image.png
George R. KasicaEngineering Operations Analyst III

Author

Commented:
THe thought we had was could we USe IISCrypto and Set up one system as needed then export the key as you suggested Patrick. Not sure if that will show the Ciphers or not. We'll try it here and see what it looks like. We WERE able to do that for the SSL items. Might be a day or 3 for results please be patient.
Patrick BogersDatacenter platform engineer Lindows
CERTIFIED EXPERT

Commented:
Hi George,

Yes it Will do exactly that (did the same on my platform last year)
Make the change and test that one machine with qualys ssl labs.

Take your time, it is mission critical. Dont forget to backup your registry.....

Cheers
btanExec Consultant
CERTIFIED EXPERT
Distinguished Expert 2019
Commented:
This problem has been solved!
(Unlock this solution with a 7-day Free Trial)
UNLOCK SOLUTION
George R. KasicaEngineering Operations Analyst III

Author

Commented:
Thank you will take a look at this tomorrow.
CERTIFIED EXPERT
Distinguished Expert 2019
Commented:
This problem has been solved!
(Unlock this solution with a 7-day Free Trial)
UNLOCK SOLUTION
George R. KasicaEngineering Operations Analyst III

Author

Commented:
yes they are. where/how would they be set in GPO? That's something we've never looked at. it sure would make it easy though.
arnold
CERTIFIED EXPERT
Distinguished Expert 2019

Commented:
Computer GPO/P security settings/registry is one way to push the registry.
Check advanced templates dealing with security.
https://technet.microsoft.com/en-us/library/cc753092(v=ws.11).aspx

test first on a subset. note usually a GPO takes two loads to apply, in acomputer gpo that might require two reboots ...
btanExec Consultant
CERTIFIED EXPERT
Distinguished Expert 2019

Commented:
You can look at administrative template for Group Policy
https://github.com/Crosse/SchannelGroupPolicy/blob/master/README.md
George R. KasicaEngineering Operations Analyst III

Author

Commented:
Looking at this as well
George R. KasicaEngineering Operations Analyst III

Author

Commented:
Ended up using regdiff take before and after snapshots on a clean server with IIScrypto to get the chages as a .reg file we could apply. Patrick that is appropriate.
Patrick BogersDatacenter platform engineer Lindows
CERTIFIED EXPERT

Commented:
Thank you for feedback.
If my proposal is appropiate why did you offer all points to btan?
Patrick BogersDatacenter platform engineer Lindows
CERTIFIED EXPERT

Commented:
Nice fix! Until Next time.

Gain unlimited access to on-demand training courses with an Experts Exchange subscription.

Get Access
Why Experts Exchange?

Experts Exchange always has the answer, or at the least points me in the correct direction! It is like having another employee that is extremely experienced.

Jim Murphy
Programmer at Smart IT Solutions

When asked, what has been your best career decision?

Deciding to stick with EE.

Mohamed Asif
Technical Department Head

Being involved with EE helped me to grow personally and professionally.

Carl Webster
CTP, Sr Infrastructure Consultant
Empower Your Career
Did You Know?

We've partnered with two important charities to provide clean water and computer science education to those who need it most. READ MORE

Ask ANY Question

Connect with Certified Experts to gain insight and support on specific technology challenges including:

  • Troubleshooting
  • Research
  • Professional Opinions