How to Disable TLS on a Windows 2008 Server. On W2K8 R2 SP1 servers and higher, support for TLS 1.1 and TLS 1.2 are supported. Disable TLS 1.0: - Enable TLS 1.2: HKEYLOCALMACHINE SYSTEM CurrentControlSet Control SecurityProviders SCHANNEL Protocols TLS 1.2 - Reboot the server to pick up the changes. Update to add RDS support for TLS 1.1 and TLS 1.2 in Windows 7 or Windows Server 2008 R2. This update provides support for Transport Layer Security (TLS) 1.1 and TLS 1.2 in Windows 7 Service Pack 1 (SP1) or Windows Server 2008 R2 SP1 for Remote Desktop Services (RDS). For more information about how to enable or disable TLS, see the TLS/SSL Settings.

• Windows Server 2008 R2 Rdp Disable Tls 1.0
• Windows Server 2008 Tls Support
• Windows 2008 Rdp Tls Update
• Windows 2008 Rdp Tls Download
• Windows 2008 Rdp Tls Free
• Windows 2008 Sp2 Rdp Enable Tls 1.2 Broke

The problem is not exactly with RDP but rather once the TLS 1.1 or 1.2 connection is made to the gateway, this becomes an WinHTTP SSL connection. When Windows 7 tries to make an RDP connection through the gateway it uses TLS 1.0 to connect. Same problem occurs with published RDWEB apps when TLS 1.0 is disabled and a Windows 7 client tries to connect. Jul 20, 2017  This post is authored by Arden White, Senior Program Manager, Windows Servicing and Delivery. As a follow-up to our announcement regarding TLS 1.2 support at Microsoft we are announcing that support for TLS1.1/TLS 1.2 on Windows Server 2008 is now available for download as of July 18th, 2017. We’re offering this support in recognition that.

Hi There, I'm going about enabling TLS 1.2 on some Windows Server 2008 R2 SP1 servers, but am looking for a solid answer on what I need to do. I've found multiple articles online suggesting that its a. If you're coming to RDS from Windows Server 2008 Terminal Services, you will not see as many dramatic changes as if you have upgraded from Windows Server 2003. WS 2008 added some big improvements to Terminal Services, including TS Web Access for connecting via a browser, the TS Gateway for users connecting across the Internet, RemoteApp for delivering individual applications to users over the Remote Desktop Protocol (RDP) and the Session Broker which included a load balancing feature. Aug 18, 2010  Remote Desktop Services in Windows Server 2008 R2 greatly extends the functionality of its predecessor, Terminal Services - but it also presents some new security issues that need to.

This post is authored by Arden White, Senior Program Manager, Windows Servicing and Delivery.

As a follow-up to our announcement regarding TLS 1.2 support at Microsoft we are announcing that support for TLS1.1/TLS 1.2 on Windows Server 2008 is now available for download as of July 18th, 2017. We’re offering this support in recognition that our customers have a strong demand for support for these newer protocols in their environment and in recognition of the extended lifetime of Windows Server 2008 under the Windows Server Premium Assurance offering.

This update for Windows Server 2008 will include support for both TLS 1.1 and TLS 1.2. For application compatibility purposes, these protocols will be disabled by default in a manner similar to the TLS 1.1/TLS 1.2 support that was disabled by default in Windows 7 and Windows Server 2008 R2. After downloading and installing the update these protocols can be enabled by setting the registry keys described in KB4019276.

This update is being made available on the following timeline:

Our credit card processor recently notified us that as of June 30, 2016 we will need to disable TLS 1.0 to remain PCI compliant. I tried to be proactive by disabling TLS 1.0 on our Windows Server 2008 R2 machine, only to find that immediately after reboot I was completely unable to connect to it via Remote Desktop Protocol (RDP). After some research, it appears that RDP only supports TLS 1.0 (see here or here), or at least it's not clear how to enable RDP over TLS 1.1 or TLS 1.2. Does anybody know a way to disable TLS 1.0 on Windows Server 2008 R2 without breaking RDP? Does Microsoft plan support for RDP over TLS 1.1 or TLS 1.2?

Note: There appears to be a way to do it by configuring the server to use the RDP Security Layer but that disables Network Level Authentication, which seems like trading one evil for another.

UPDATE 1: Microsoft has now addressed this issue. See the answer below for the relevant server update.

UPDATE 2: Microsoft has released a tutorial regarding SQL Server Support for PCI DSS 3.1.

9 Answers

Microsoft released the patch for this problem Sep 15, 2015

See https://support.microsoft.com/en-us/kb/3080079

I have been looking into this for a couple of days now as we to have to comply with PCI-DSS 3.1 which requires TLS 1.0 to be disabled.

We also do not want to fall back to RDP Security Layer which is a major security concern.

I have finally managed to find some documentation that confirms that TLS 1.1 and TLS 1.2 ARE supported by RDP. This documentation is hidden away in an SChannel logging and a very detailed specification for RDP.

There is a complete lack of main stream documentation on Technet or other Microsoft sites it seems so hopefully documenting this here may help some people.

Relevant extracts from the links provided:

From the MSDN link:

From the RDP specification PDF:

Therefore one would conclude that you can use TLS 1.1 or 1.2 on Windows Server 2008 R2 according to this documentation.

However our testing has proved this DOES NOT work from the Windows 7 RDP client (version 6.3.9600) when TLS 1.0 is disabled and RDP security option is set to require TLS 1.0.

This is of course as well as enabling TLS 1.1 and 1.2 which are off by default on 2008R2 - incidentally we do this using the very useful IIS Crypto Tool from Nartac Software.

When looking at this issue it is useful to enable SChannel logging to see the more details of what is happening when your session is opened.

You can set SChannel logging by changing the HKEY_LOCAL_MACHINESystemCurrentControlSetControlSecurityProvidersSCHANNELEventLogging key to 5 and rebooting.

Once this has been done you can observe SChannel events which show the TLS version being used when an RDP connection is made.Once logging is enabled, you can observe the SChannel error when the RDP client tries to establish a connection on Windows 2008 R2 with TLS 1.0 disabled:

I have also tested disabling TLS 1.0 on Windows Server 2012 and 2012 R2 which I can confirm works perfectly using the Windows 7 RDP Client. SChannel log entry shows TLS 1.2 being used:

I hope this helps someone who is looking for clarification on this.

I will continue to look for how we might get RDP working over TLS 1.1 and TLS 1.2 in Windows Server 2008 R2.

UPDATE: 2015-AUG-05

We raised the issue of RDP not working with Server 2008 R2 with Microsoft support including steps to reproduce.

After several weeks of backwards and forwards we finally received a phone call today from the support team to acknowledge that they could indeed reproduce it and this is now categorized as a bug. An update patch will be released, at the moment this is expected this in October 2015. As soon as I have a KB article or other details I will add them to this post.

Hopefully those stuck with Windows Server 2008 R2 can at least get this resolved before the deadline of June 2016 once the patch is released.

UPDATE: 19th September 2015

Microsoft have finally released a kb support article about this here and I can confirm that it works OK.

Use IPsec instead, as the document recommends: 'Setting up a strongly-encrypted session first (e.g. IPsec tunnel), then sending data over SSL within secure tunnel '

The main reason to do this over configuring TLS for RDP is that the firewall policy is easily audited for compliance (vs proving a buch of registry changes are compliant) and IPsec is pretty easy to configure in windows.

If you happen to need full suite B compliance IPSEC with tls 1.0 is the only way available to apply to appropriate certificate lengths

This is not an answer to the question, but to the sub-question 'How do I restore remote access to a virtual machine where I've disabled TLS 1.0 and with no physical access?'.

I disabled TLS 1.0 using IISCrypto, which gave a useful warning about the side effect that RDP will stop working if it is set to TLS. So I checked in:

and my Security Level was set to 'Negotiate'. I assumed this means if TLS is not available, it would gracefully degrade to RDP Security.

But no, Negotiate doesn't work that way. You have to set Security Level to RDP Security, not Negociate, before you disable TLS 1.0.

So I lost my ability to remote connect to my AWS instance!

To reconnect, I used another AWS instance.

1. I updated the SecurityGroup to allow firewall connection from that machine to my 'lost' machine.
2. I opened an administrative network share in DOS, with an admin user and password:

net use lost_machine_ipc$

3. Then I opened Regedit, and in File menu, choose 'Connect Network Registry' and put in the IP of the 'lost' server.You should see the remote server registry. Go to :

SYSTEMCurrentControlSetControlTerminal ServerWinStationsRDP-Tcp

and set the value for SecurityLayer to 0 (0 is RDP Security).

You will then be able to remote connect, and reenable TLS 1.0 in IISCrypto if required.

You will need to install RDP 8.0 on your Windows 7 computers and Windows Server 2008 R2 servers, and then enable RDP 8.0 on the local computer policy or group policy.

Here is the Microsoft KB for the RDP 8.0.https://support.microsoft.com/en-us/kb/2592687

Once this is done you should be able to disable TLS 1.0 on the computers and servers by editing the registry as instructed in this technet article.https://technet.microsoft.com/en-us/library/dn786418.aspx

After installing RDP 8.0 you can also install RDP 8.1, but RDP 8.0 must be installed prior to installing RDP 8.1. RDP 8.0 contains both the client and server-side protocol components, but RDP 8.1 only includes the client. The Microsoft KB for RDP 8.1 is KB2830477.

I made these changes on one of my windows 7 workstations and tested the RDP connections with the 'Require use of specific security layer for remote (RDP) connections' Group Policy setting enabled and set to 'SSL (TLS 1.0)' to ensure that it would not fall back to RDP Encryption.

UPDATE 6/19/2015:

I finally got a chance to test this on one of our Windows Server 2008 R2 servers, and it definitely breaks RDP connections to the server. It seems that the RDP 8.0 server-side components are only installed on Windows 7 computers, and do not get installed on Windows Server 2008 R2 servers.

As posted on How to disable TLS 1.0 without breaking RemoteApps on server 2012 R2 but reposting here for the benefit of those that may not be monitoring that link:

After almost a year, I finally figured out a working solution for disabling TLS 1.0/1.1 without breaking RDP and Remote Desktop Services connectivity and launching RemoteApps:

Windows Server 2008 R2 Rdp Disable Tls 1.0

Run IISCrypto and disable TLS 1.0, TLS 1.1 and all bad ciphers.

On the Remote Desktop Services server running the gateway role, open the Local Security Policy and navigate to Security Options - System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing. Change the security setting to Enabled. Reboot for the changes to take effect.

Note that in some cases (especially if using self signed certificates on Server 2012 R2), the Security Policy option Network Security: LAN Manager authentication level may need to be set to Send NTLMv2 responses only.

Just an update on this if anyone else is looking for info on it.For my Windows 7 64-bit boxes I had to install KB2574819 (first) and KB2592687 (second)Windows 7 has to have SP1 installed before those 2 pkgs will install.If you have issues installing SP1 like I did, I had to uninstall KB958830 first, then install SP1.

For my Windows Server 2008 R2 boxes, I had to install KB3080079.Once you do this and have all the appropriate settings for secure communication put in place, then it will use TLS 1.2You can confirm by using Wireshark to perform a capture of the communication between your two boxes.

Windows Server 2008 Tls Support

I've successfully used rdesktop (http://www.rdesktop.org) for Linux to work around this problem.

Windows 2008 Rdp Tls Update

One case not covered by the existing answers: Windows 7 clients connecting through an RDP Gateway will still use TLS 1.0 when connecting to the gateway and fail if the gateway does not support TLS 1.0, even after applying KB3080079, as observed in this TechNet forum thread.

To use TLS 1.2 for connecting through an RDP Gateway, ensure KB3140245 is installed and add the following registry keys (save in a file with .reg extension to import):

As documented in KB3140245, this will override WINHTTP_OPTION_SECURE_PROTOCOLS to use TLS 1.2 (and only TLS 1.2) by default. So be aware it will affect more than just the RDP client.

(Note: If backwards-compatibility is desired, dword:00000800 can be changed to dword:00000A00 or dword:00000A80 to include TLS 1.1 and 1.0 respectively)

Windows 2008 Rdp Tls Download

protected by Community♦Mar 5 '16 at 15:12

Windows 2008 Rdp Tls Free

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).
Would you like to answer one of these unanswered questions instead?

Windows 2008 Sp2 Rdp Enable Tls 1.2 Broke

Not the answer you're looking for? Browse other questions tagged windows-server-2008-r2sslrdptlspci-dss or ask your own question.