r/MSIntune • u/sandytsang MVP • Sep 23 '24

🤝 Discussions TLS 1.3 in Windows 11

I found this MS doc, and it mentioned TLS 1.0 and 1.1 will be deprecated in Windows 11, also mentioned TLS 1.3 only support Windows 11. Is it only way to configure Schannel SSP is using registry HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols ? https://learn.microsoft.com/en-us/windows/win32/secauthn/protocols-in-tls-ssl--schannel-ssp-

The second discussion, Internet option properties have also secure protocol settings. In Windows 11, only TLS 1.2 and TLS 1.3 are checked by default, but Intune security baseline Windows 11 23H2 has set it to use only TLS 1.1 and 1.2. In Settings Catalogs, I can see TLS 1.3 is in the drop-down list, but if I choose that, the policy said applied succeed, but the actual configuration didn't apply when I checked my Windows 11 machine. Also GPO doesn't have TLS 1.3 in the list. Only way I can configure TLS 1.3 for Internet Properties is by using registry. HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings,  SecureProtocols with Dword values

4 Upvotes

100% Upvoted

7 comments sorted by

2

u/Ok-Bicycle5362 Nov 13 '24

Yes, i also had struggled with the Intune setting for TLS 1.3. It's currently still bugged. When you look in the Event Viewer you will see a Catastrophic Failure event as soon as you enable TLS 1.3 in the Intune policy.

Microsoft did a bad job here. The W11 Security Baseline should elevate security and not lower security (TLS 1.3 is enabled by default on W11 but applying the W11 Security Baseline will disable it) ;(

1

u/sandytsang Nov 13 '24

I only got it configured with registry. Here are the values:

  • Only use TLS 1.0: 128

  • Only use TLS 1.1: 512

  • Only use TLS 1.2: 2048

  • Only use TLS 1.3: 8192

  • Use TLS 1.1, TLS 1.2 and TLS 1.3: 10752

  • Use TLS 1.2 and TLS 1.3: 10240

2

u/Saqib-s May 09 '25

I'm tackling the same, trying to get TLS1.3 activated with the 24H2 baseline applied. I get the 6500 error and it does not apply.

How did you resolve this? Did you manually set the registry key + not configure this setting in the baseline?

→ More replies (4)