How to Disable TLS 1.0 and 1.1 on Windows Server Safely

AvatarByEric Dawson Computers & Software

To disable TLS 1.0 and 1.1 on Windows Server, open the Registry Editor and browse to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols. Create a Client subkey and a Server subkey under both the TLS 1.0 key and the TLS 1.1 key, then add two DWORD values under each one, Enabled set to 0 and DisabledByDefault set to 1. A restart applies the change. Administrators who prefer a graphical tool can reach the same result with IIS Crypto, unchecking both protocols under Server Protocols and Client Protocols before rebooting. Microsoft is moving toward disabling TLS 1.0 and 1.1 by default because both protocols carry known security weaknesses, but the change can break legacy software and older client devices that never learned TLS 1.2, so test it before it reaches a production server.

How to Disable TLS 1.0 and 1.1 on Windows Server with the Registry

The registry method turns off TLS 1.0 and 1.1 completely, for every application on the server, by writing Enabled and DisabledByDefault values under four subkeys, one Client key and one Server key beneath each protocol. Microsoft Q&A and Windows OS Hub both treat this as the definitive fix, since Internet Options and Group Policy only cover part of what runs on a server.

Creating the Protocol Subkeys

Four new keys need to exist before any values can be set. Follow these steps in Registry Editor.

  1. Open Registry Editor. Press the Windows key, type regedit, and press Enter.
  2. Go to the Protocols key. Paste this path into the address bar: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols.
  3. Add the TLS 1.0 key. Right-click Protocols, choose New, then Key, and name it TLS 1.0.
  4. Add the TLS 1.1 key. Repeat the same step, naming the new key TLS 1.1.
  5. Add Client and Server subkeys. Under both TLS 1.0 and TLS 1.1, right-click and create two more keys named Client and Server, four subkeys in total.

Setting the Enabled and DisabledByDefault Values

Each of the four subkeys needs the same two DWORD values, only the numbers differ from the defaults.

  1. Open a subkey. Click into TLS 1.0\Server first.
  2. Create the Enabled value. Right-click an empty area, choose New, then DWORD (32-bit) Value, name it Enabled, and set the data to 0.
  3. Create the DisabledByDefault value. Repeat the process, naming the value DisabledByDefault, and set the data to 1.
  4. Repeat for the other three subkeys. Do the same in TLS 1.0\Client, TLS 1.1\Server, and TLS 1.1\Client.
  5. Restart the server. None of the four changes take effect until the server reboots.

Picture the finished result under TLS 1.0\Server: Enabled holds 0 and DisabledByDefault holds 1, and the same pair of numbers sits under the other three subkeys once the work is done. Microsoft’s own deprecation guide is blunt about the risk in this step: it advises against editing the registry directly unless there is no other option, since an incorrect value here can produce an unrecoverable error, and it recommends Group Policy or another Windows management console first where either one will do the job.

How to Disable TLS 1.0 and 1.1 with IIS Crypto

IIS Crypto disables TLS 1.0 and 1.1 in a few clicks, without opening Registry Editor at all, by letting an administrator uncheck both protocols in its Server Protocols and Client Protocols lists. Nartac Software builds the tool as a free download that covers Windows Server 2012 through Windows Server 2025, and it ships in both a graphical version and a command-line version for scripted deployments.

  1. Download IIS Crypto. Get the current build from the Nartac Software website.
  2. Run it as administrator. Right-click the executable and choose Run as administrator, since the tool writes to the same registry keys covered above.
  3. Back up the current settings. Use the built-in backup option before changing anything, so the prior configuration can be restored if something goes wrong.
  4. Uncheck TLS 1.0 and TLS 1.1 under Server Protocols. Clear both boxes in that column.
  5. Uncheck TLS 1.0 and TLS 1.1 under Client Protocols. Clear the matching boxes in that column too.
  6. Apply and reboot. Click Apply, then restart the server for the change to take hold.

A Best Practices template ships with the tool as well, which disables TLS 1.0 and 1.1 along with other weak protocols and ciphers in one pass, a faster route for administrators who want the current recommended baseline rather than picking protocols individually.

How to Disable TLS 1.0 and 1.1 in Internet Options

Internet Options only affects Internet Explorer and the applications that read its WinINet settings, not the full Schannel stack the registry method controls, so use it alongside the registry fix rather than instead of it. The path is a short one through Control Panel.

  1. Open Internet Options. Go to Control Panel, then Network and Internet, then Internet Options.
  2. Switch to the Advanced tab. Scroll down to the Security section.
  3. Uncheck Use TLS 1.0. Clear that box.
  4. Uncheck Use TLS 1.1. Clear that box as well.
  5. Confirm TLS 1.2 stays checked. Leave Use TLS 1.2, or a higher version where listed, selected.
  6. Apply the change. Click Apply, then OK.

Can Group Policy Disable TLS 1.0 and 1.1 on Windows Server

Group Policy can reach a related setting, but it cannot disable TLS 1.0 and 1.1 on its own while leaving only TLS 1.2 and TLS 1.3 enabled, so Windows OS Hub recommends the registry method as the more complete option. The relevant policy sits at Computer Configuration, then Administrative Templates, then Windows Components, then Internet Explorer, then Internet Explorer Control Panel, then Advanced Page, under a setting called Turn Off Encryption Support.

Enabling that setting removes encryption options from the interface rather than granularly selecting which protocol versions stay active, which is why it falls short of a full TLS 1.0 and 1.1 removal. Group Policy is still useful for pushing a script or a registry-based configuration across many servers at once, just not as the mechanism that disables the protocols by itself.

How to Disable TLS 1.0 and 1.1 with PowerShell

PowerShell reaches the same four registry subkeys as the manual method, using the Set-ItemProperty cmdlet to write Enabled and DisabledByDefault values from a script instead of clicking through Registry Editor by hand. The documented script in the sources for this article is built to enable, or re-enable, TLS 1.0 and 1.1, which makes it most useful for rollback, covered further down this page. That same cmdlet syntax against the same four paths works in the opposite direction for disabling, since a script and a mouse are just two ways of writing the identical registry values.

Scripting earns its keep on a fleet of servers, where opening Registry Editor sixty times is not practical. One Set-ItemProperty command per value, run through remote PowerShell or a configuration management tool, applies the same four subkeys everywhere in minutes rather than hours.

Why Is Microsoft Deprecating TLS 1.0 and 1.1

Microsoft is deprecating TLS 1.0 and 1.1 because both protocols have known security weaknesses that internet standards bodies no longer consider acceptable, formalized in RFC 8996, which deprecates them outright. Its guidance tells customers to remove any remaining dependency on the two protocols rather than wait for a forced cutoff.

The rollout has moved in stages rather than all at once. Packages.microsoft.com dropped support for TLS 1.0 and 1.1 on September 24, 2020. The Microsoft Teams desktop application followed on July 7, 2021. Internet Explorer’s own disablement was announced in 2020 and then postponed to 2022. Microsoft 365 applications, along with the WinHTTP and WinINet programming interfaces, have already had TLS 1.0 and 1.1 turned off. Windows 11 Insider Preview builds and Windows Server 2024 Insider Preview builds began disabling the two protocols by default during 2024, though Microsoft’s documentation is clear that this does not reach in-market, generally available operating system versions as of March 2024.

Nothing here forces an immediate change on a server running a supported, in-market build, but the direction is set. Microsoft’s own wording notes that support for the legacy protocols may be removed completely at some point in the future, which is the practical argument for testing a phased removal now rather than later under pressure.

Which Applications Break When TLS 1.0 and 1.1 Are Disabled

Several widely used applications lose functionality once TLS 1.0 and 1.1 are turned off, and Microsoft has documented a specific list of them by name, reproduced in the table below. Older builds are the common thread, and most have a newer release that already speaks TLS 1.2 or better.

Application Impacted Version Fixed Version
ACDSee Photo Studio 2018 2023
ArcGIS 10.3 11.1
ESET NOD32 Antivirus 5.0.94.0 10.0.390.0
Jaws for Windows 2019.1903.47 2023.2307.37
K7 Enterprise Security 4.1.0.116 4.5.1.121
Microsoft Office 2008 Professional Accounting Express 2008 Not available
SQL Server 2012, 2014, 2016 2014 and 2016, patched, and 2019 and later
TurboTax 2011 to 2018 2022
UltraViewer 6.6.37 6.6.63

Microsoft maintains a fuller list of affected software in its TLS deprecation documentation, useful for checking a product not named in the table above.

Two entries deserve a second look before assuming an upgrade fixes everything. Microsoft Office 2008 Professional Accounting Express has no fixed version listed at all, meaning that application stops working over TLS entirely once the older protocols are gone. SQL Server needs care as well, since only patched builds of the 2014 and 2016 releases gained TLS 1.2 support, an unpatched instance on either version behaves the same as the older, broken one.

Comparing the Five Ways to Disable TLS 1.0 and 1.1

Five methods can disable TLS 1.0 and 1.1 on Windows Server, and they differ mainly in complexity, whether a GUI exists, and how completely each one covers the server rather than just Internet Explorer. The table below lines them up side by side.

Method Complexity GUI Available Requires Restart Supported Server Versions
Direct registry editing High No Yes All server versions
Internet Options Low Yes, Control Panel No, IE only All server versions
IIS Crypto Low Yes Yes 2012 through 2025
Group Policy Medium Yes Yes All server versions, limited granularity
PowerShell script Medium No Yes All server versions

For a single server, IIS Crypto is the fastest path to a correct result, since its checkboxes remove the chance of a typo in a registry value. Fleets of servers favor PowerShell or a Group Policy-delivered script instead, because clicking through IIS Crypto or Registry Editor by hand does not scale past a handful of machines. Internet Options is worth setting alongside either approach, since it closes the Internet Explorer gap that the other four methods do not touch.

My choice for a single server would be IIS Crypto rather than direct registry editing. Both routes require a restart and can disable the same client and server protocols, but the graphical checkboxes and built in backup reduce the chance of a small registry mistake becoming a larger recovery problem. For a fleet of servers, I would instead use a PowerShell or registry based deployment after confirming that older applications and clients can use TLS 1.2 or later. Internet Options is too narrow to be my main control.

What to Do if Disabling TLS 1.0 and 1.1 Breaks Something

Reverse the change by setting Enabled back to 1 and DisabledByDefault back to 0 on the same four registry subkeys, or by rerunning IIS Crypto and rechecking the two protocols, then restarting the server again. Both routes undo the change in the same amount of time it took to apply it.

Testing Before a Production Rollout

A controlled environment catches most problems before they reach users. Build the same registry or IIS Crypto change on a test server first, then run whatever applications, backup agents, monitoring tools, and third-party integrations the production server depends on against it. Checking the applications table earlier on this page against the software inventory is a reasonable first pass, since several of the named entries, older SQL Server builds among them, are common on business servers.

Rolling Back Quickly

Keep a record of exactly what changed before making it, four subkeys and eight values for the registry method, or an IIS Crypto backup file if that tool made the change. Restoring from either one is faster than rebuilding the settings from memory during an outage. PowerShell script rollback, covered further up this page, applies the same restore across many servers at once rather than one at a time.

Legacy systems and third-party applications are worth identifying by name before any of this work starts, not after a helpdesk ticket arrives. An inventory built in advance turns a surprise outage into a planned exception, where a handful of older systems keep the legacy protocols a while longer while the rest of the environment moves on.

Frequently Asked Questions

Can I Re-Enable TLS 1.0 and 1.1 After Disabling Them?

Yes. Set Enabled back to 1 and DisabledByDefault back to 0 on the same four registry subkeys, or use the PowerShell script documented for that purpose with the Set-ItemProperty cmdlet, then restart the server. IIS Crypto users can recheck the two protocols in the same two columns they unchecked, or restore the backup file the tool created before the original change.

Is IIS Crypto Free to Use?

IIS Crypto is free, distributed by Nartac Software as both a graphical application and a command-line version. It covers Windows Server 2012 through Windows Server 2025, spanning most of what is still in production today.

Does Group Policy Fully Replace the Registry Method?

No. The Group Policy setting for encryption support cannot leave only TLS 1.2 and TLS 1.3 enabled, so it lacks the granularity the registry method provides. Windows OS Hub recommends the registry approach as the more complete option, with Group Policy better suited to distributing that configuration across many machines.

Do I Need to Restart the Server After Disabling TLS 1.0 and 1.1?

Yes, in every method documented here. Registry edits, IIS Crypto changes, and Group Policy settings all require a restart before Windows applies the new protocol configuration. Internet Options is the one exception, since it only affects Internet Explorer and takes effect without a reboot.

What Happens if I Skip Testing Before Disabling These Protocols in Production?

Applications that still depend on TLS 1.0 or TLS 1.1 stop connecting, sometimes without an error message that points to the cause. Older builds of SQL Server, ACDSee Photo Studio, ArcGIS, and ESET NOD32 antivirus are documented examples, among others listed earlier on this page. Testing on a non-production server first is the difference between a planned exception list and an unplanned outage.

Four registry subkeys, two DWORD values apiece, cover the core of this change, and IIS Crypto reaches the identical result without opening Registry Editor at all. Pair either one with the Internet Options setting to close the Internet Explorer gap, skip Group Policy as a stand-alone fix, and keep a rollback plan ready given how many still-common applications depend on the protocols being removed.

What This Page Does Not Publish

  • I do not map compatibility for specific third-party applications, payment services, or older devices, so test the systems your server must support.
  • I do not measure performance changes after disabling these protocols; the decision here is about security and compatibility.
  • This page does not give personalised advice.

References

Author Profile

Eric Dawson
Eric Dawson
I'm Eric Dawson, the writer behind The Money Watch. I live in the Columbus, Ohio area and I write about the ordinary questions that turn out to be complicated: computers, shopping, food, travel, parking, small businesses, fees, rules and products. Every article starts with the official page, the maker or the agency, then the sources that check it, and I say plainly where they disagree and what I would do. More about how I work is on the About page.