How to Disable TLS 1.0 and 1.1 on Windows Server Safely

Eric DawsonByEric Dawson Updated Computers & Software

To disable TLS 1.0 and 1.1 on Windows Server, open the Registry Editor and browse to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols. Create a Client subkey and a Server subkey under both the TLS 1.0 key and the TLS 1.1 key, then add two DWORD values under each one, Enabled set to 0 and DisabledByDefault set to 1. A restart applies the change. Administrators who prefer a graphical tool can reach the same result with IIS Crypto, unchecking both protocols under Server Protocols and Client Protocols before rebooting. Microsoft is moving toward disabling TLS 1.0 and 1.1 by default because both protocols carry known security weaknesses, but the change can break legacy software and older client devices that never learned TLS 1.2, so test it before it reaches a production server.

How to Disable TLS 1.0 and 1.1 on Windows Server with the Registry

The registry method applies the change across the server. Microsoft Q&A and Windows OS Hub both treat this as the definitive fix, since Internet Options and Group Policy only cover part of what runs on a server.

Creating the Protocol Subkeys

Four new keys need to exist before any values can be set. Follow these steps in Registry Editor.

  1. Open Registry Editor. Press the Windows key, type regedit, and press Enter.
  2. Go to the Protocols key. Paste this path into the address bar: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols.
  3. Add the TLS 1.0 key. Right-click Protocols, choose New, then Key, and name it TLS 1.0.
  4. Add the TLS 1.1 key. Repeat the same step, naming the new key TLS 1.1.

Setting the Enabled and DisabledByDefault Values

Each of the four subkeys needs the same two DWORD values, only the numbers differ from the defaults.

  1. Open a subkey. Click into TLS 1.0\Server first.
  2. Create the Enabled value. Right-click an empty area, choose New, then DWORD (32-bit) Value, name it Enabled, and set the data to 0.
  3. Create the DisabledByDefault value. Repeat the process, naming the value DisabledByDefault, and set the data to 1.
  4. Repeat for the other three subkeys. Do the same in the remaining subkeys.
  5. Restart the server. None of the four changes take effect until the server reboots.

Picture the finished result under TLS 1.0\Server: Enabled holds 0 and DisabledByDefault holds 1, and the same pair of numbers sits under the other three subkeys once the work is done. Microsoft’s own deprecation guide is blunt about the risk in this step: it advises against editing the registry directly unless there is no other option, since an incorrect value here can produce an unrecoverable error, and it recommends Group Policy or another Windows management console first where either one will do the job.

How to Disable TLS 1.0 and 1.1 with IIS Crypto

IIS Crypto disables TLS 1.0 and 1.1 in a few clicks, without opening Registry Editor at all, by letting an administrator uncheck both protocols in its Server Protocols and Client Protocols lists. Nartac Software builds the tool as a free download that covers Windows Server 2012 through Windows Server 2025, and it ships in both a graphical version and a command-line version for scripted deployments.

  1. Download the tool. Get the current build from the Nartac Software website.
  2. Run it as administrator. Right-click the executable and choose Run as administrator, since the tool writes to the same registry keys covered above.
  3. Back up the current settings. Use the built-in backup option before changing anything, so the prior configuration can be restored if something goes wrong.
  4. Clear the matching Client Protocols boxes.
  5. Apply and reboot. Click Apply, then restart the server for the change to take hold.

A Best Practices template ships with the tool as well, which disables TLS 1.0 and 1.1 along with other weak protocols and ciphers in one pass, a faster route for administrators who want the current recommended baseline rather than picking protocols individually.

How to Disable TLS 1.0 and 1.1 in Internet Options

Internet Options only affects Internet Explorer and the applications that read its WinINet settings, not the full Schannel stack the registry method controls, so use it alongside the registry fix rather than instead of it. The path is a short one through Control Panel.

  1. Open Internet Options. Go to Control Panel, then Network and Internet, then Internet Options.
  2. Switch to the Advanced tab. Scroll down to the Security section.
  3. Uncheck Use TLS 1.0. Clear that box.
  4. Uncheck Use TLS 1.1. Clear that box as well.
  5. Confirm TLS 1.2 stays checked. Leave Use TLS 1.2, or a higher version where listed, selected.
  6. Apply the change. Click Apply, then OK.

Can Group Policy Disable TLS 1.0 and 1.1 on Windows Server

Group Policy can reach a related setting, but it cannot disable TLS 1.0 and 1.1 on its own while leaving only TLS 1.2 and TLS 1.3 enabled, so Windows OS Hub recommends the registry method as the more complete option. The relevant policy sits at Computer Configuration, then Administrative Templates, then Windows Components, then Internet Explorer, then Internet Explorer Control Panel, then Advanced Page, under a setting called Turn Off Encryption Support.

Enabling that setting lets administrators select permitted TLS/SSL versions from the Secure Protocol combinations dropdown, but it does not provide the complete server-side configuration described earlier. Group Policy is still useful for pushing a script or a registry-based configuration across many servers at once, just not as the mechanism that disables the protocols by itself.

How to Disable TLS 1.0 and 1.1 with PowerShell

PowerShell reaches the same four registry subkeys as the manual method, using the Set-ItemProperty cmdlet to write Enabled and DisabledByDefault values from a script instead of clicking through Registry Editor by hand.

The documented script in the sources for this article is built to enable, or re-enable, TLS 1.0 and 1.1, which makes it most useful for rollback, covered further down this page. That same cmdlet syntax against the same four paths works in the opposite direction for disabling, since a script and a mouse are just two ways of writing the identical registry values.

Scripting earns its keep on a fleet of servers, where opening Registry Editor sixty times is not practical. One Set-ItemProperty command per value, run through remote PowerShell or a configuration management tool, applies the same four subkeys everywhere in minutes rather than hours.

Why Is Microsoft Deprecating TLS 1.0 and 1.1

RFC 8996 deprecates them outright, and Microsoft’s guidance tells customers to remove any remaining dependency on the two protocols rather than wait for a forced cutoff.

The rollout has moved in stages rather than all at once. Packages.microsoft.com dropped support for TLS 1.0 and 1.1 on September 24, 2020. The Microsoft Teams desktop application followed on July 7, 2021. Internet Explorer’s own disablement was announced in 2020 and then postponed to 2022.

Microsoft 365 applications, along with the WinHTTP and WinINet programming interfaces, have already had TLS 1.0 and 1.1 turned off. Windows 11 Insider Preview builds and Windows Server Insider Preview builds began disabling the two protocols by default during 2024, though Microsoft’s documentation is clear that this does not reach in-market, generally available operating system versions as of March 2024.

Nothing here forces an immediate change on a server running a supported, in-market build, but the direction is set. Microsoft’s own wording notes that support for the legacy protocols may be removed completely at some point in the future, which is the practical argument for testing a phased removal now rather than later under pressure.

Which Applications Break When TLS 1.0 and 1.1 Are Disabled

Several widely used applications lose functionality once TLS 1.0 and 1.1 are turned off, and Microsoft has documented a specific list of them by name, reproduced in the table below. Older builds are the common thread, and most have a newer release that already speaks TLS 1.2 or better.

Application Impacted Version Fixed Version
ACDSee Photo Studio 2018 2023
ArcGIS 10.3 11.1
ESET NOD32 Antivirus 5.0.94.0 10.0.390.0
Jaws for Windows 2019.1903.47 2023.2307.37
K7 Enterprise Security 4.1.0.116 4.5.1.121
Microsoft Office 2008 Professional Accounting Express 2008 Not available
SQL Server 2012, 2014, 2016 2014 and 2016, patched, and 2019 and later
TurboTax 2011 to 2018 2022
UltraViewer 6.6.37 6.6.63

Microsoft maintains a fuller list of affected software in its TLS deprecation documentation, useful for checking a product not named in the table above.

Two entries deserve a second look before assuming an upgrade fixes everything. Microsoft Office 2008 Professional Accounting Express has no fixed version listed at all, meaning that application stops working over TLS entirely once the older protocols are gone. SQL Server needs care as well, since only patched builds of the 2014 and 2016 releases gained TLS 1.2 support, an unpatched instance on either version behaves the same as the older, broken one.

Comparing the Five Ways to Disable TLS 1.0 and 1.1

Five methods can disable TLS 1.0 and 1.1 on Windows Server, and they differ mainly in complexity, whether a GUI exists, and how completely each one covers the server rather than just Internet Explorer. The table below lines them up side by side.

Method Complexity GUI Available Requires Restart Supported Server Versions
Direct registry editing High Yes, Registry Editor Yes All server versions
Internet Options Low Yes, Control Panel No, IE only All server versions
IIS Crypto Low Yes Yes 2012 through 2025
Group Policy Medium Yes Yes All server versions, limited granularity
PowerShell script Medium No Yes All server versions

For a single server, the tool is the fastest path to a correct result, since its checkboxes remove the chance of a typo in a registry value. Fleets of servers favor PowerShell or a Group Policy-delivered script instead, because clicking through the tool or Registry Editor by hand does not scale past a handful of machines. Internet Options is worth setting alongside either approach, since it closes the Internet Explorer gap that the other four methods do not touch.

What to Do if Disabling TLS 1.0 and 1.1 Breaks Something

Reverse the change by setting Enabled back to 1 and DisabledByDefault back to 0 on the same four registry subkeys, or by rerunning the tool and rechecking the two protocols, then restarting the server again. Both routes undo the change in the same amount of time it took to apply it.

Testing Before a Production Rollout

A controlled environment catches most problems before they reach users. Build the same registry or tool based change on a test server first, then run whatever applications, backup agents, monitoring tools, and third party integrations the production server depends on against it. Checking the applications table earlier on this page against the software inventory is a reasonable first pass, since several of the named entries, older SQL Server builds among them, are common on business servers.

Rolling Back Quickly

Keep a record of exactly what changed before making it, four subkeys and eight values for the registry method, or a backup file from the tool if it made the change. Restoring from either one is faster than rebuilding the settings from memory during an outage. PowerShell script rollback, covered further up this page, applies the same restore across many servers at once rather than one at a time.

Legacy systems and third party applications are worth identifying by name before any of this work starts, not after a helpdesk ticket arrives. An inventory built in advance turns a surprise outage into a planned exception, where a handful of older systems keep the legacy protocols a while longer while the rest of the environment moves on.

Frequently Asked Questions

Can I Re-Enable TLS 1.0 and 1.1 After Disabling Them?

Yes. Set Enabled back to 1 and DisabledByDefault back to 0 on the same four registry subkeys, or use the PowerShell script documented for that purpose with the Set-ItemProperty cmdlet, then restart the server. Users can recheck the two protocols in the same two columns they unchecked, or restore the backup file the tool created before the original change.

Is This Tool Free to Use?

The tool is free, distributed by Nartac Software as both a graphical application and a command-line version. It covers Windows Server 2012 through Windows Server 2025, spanning most of what is still in production today.

Does Group Policy Fully Replace the Registry Method?

No. The Group Policy setting for encryption support cannot leave only TLS 1.2 and TLS 1.3 enabled, so it lacks the granularity the registry method provides. Windows OS Hub recommends the registry approach as the more complete option, with Group Policy better suited to distributing that configuration across many machines.

Do I Need to Restart the Server After Disabling TLS 1.0 and 1.1?

Yes, in every method documented here. Registry edits, changes made with the tool, and Group Policy settings all require a restart before Windows applies the new protocol configuration. Internet Options is the one exception, since it only affects Internet Explorer and takes effect without a reboot.

What Happens if I Skip Testing Before Disabling These Protocols in Production?

Applications that still depend on TLS 1.0 or TLS 1.1 stop connecting, sometimes without an error message that points to the cause. Older builds of SQL Server, ACDSee Photo Studio, ArcGIS, and ESET NOD32 antivirus are documented examples, among others listed earlier on this page. Testing on a non-production server first is the difference between a planned exception list and an unplanned outage.

Four registry subkeys, two DWORD values apiece, cover the core of this change, and the graphical tool reaches the identical result without opening Registry Editor at all. Pair either one with the Internet Options setting to close the Internet Explorer gap, skip Group Policy as a stand-alone fix, and keep a rollback plan ready given how many still-common applications depend on the protocols being removed.

References

Sources read in September 2026.

Eric Dawson

I'm Eric Dawson, and I write The Money Watch from north Columbus, Ohio. Most of what I cover comes from my own life: renting, a 2014 Honda Fit, parking, computers, food and the bills behind all of it. I spent four years in an apartment-property office and eleven on a distributor's operations desk, reading leases and invoices. Where you need real information, I research the maker's or agency's own page and independent sources and report what they publish. I don't give tax, investment, legal or medical advice.