How to Enable TLS 1.2 on Windows Server

TLS 1.2 is the minimum protocol most services, payment processors, and cloud APIs accept today. On current versions of Windows Server it’s already on at the operating-system level, but older servers, and older .NET Framework apps running on any version, may still try TLS 1.0 or 1.1 and fail to connect. This guide shows how to confirm and enable TLS 1.2 for Windows Server’s SChannel, .NET Framework, and WinHTTP, with the exact registry settings and PowerShell commands.

Quick Answer

Windows Server 2012 R2 and later support TLS 1.2 and have it enabled by default. To enforce it explicitly, set Enabled = 1 and DisabledByDefault = 0 under HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server and \Client, then make .NET apps use it by setting SchUseStrongCrypto and SystemDefaultTlsVersions to 1. Restart the server.

TLS 1.2 Support by Windows Server Version

Version	TLS 1.2 default	Notes
Windows Server 2022 and 2025	Enabled	TLS 1.3 also supported
Windows Server 2016 and 2019	Enabled	Check .NET settings for older apps
Windows Server 2012 R2	Enabled	Out of mainstream support; .NET and WinHTTP may need settings
Windows Server 2012 / 2008 R2	Supported but not default	Needs registry changes and updates; these versions are end of life

Before You Start

• Back up the registry (File > Export in Registry Editor) or take a VM snapshot.
• Install the latest Windows updates.
• Plan a restart; SChannel changes take effect after reboot.
• If you also plan to disable TLS 1.0/1.1, test that all clients and apps support TLS 1.2 first.

Step 1: Enable TLS 1.2 in SChannel

Run this in an elevated PowerShell window:

$base = 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2'
foreach ($side in 'Server','Client') {
  New-Item -Path "$base\$side" -Force | Out-Null
  New-ItemProperty -Path "$base\$side" -Name 'Enabled' -Value 1 -PropertyType DWord -Force | Out-Null
  New-ItemProperty -Path "$base\$side" -Name 'DisabledByDefault' -Value 0 -PropertyType DWord -Force | Out-Null
}

To do it manually, open regedit, create the TLS 1.2, Server, and Client keys if missing, and add the two DWORD values to each.

Step 2: Make .NET Framework Apps Use TLS 1.2

Older .NET Framework apps may default to TLS 1.0 regardless of SChannel. Set these values for both 64-bit and 32-bit .NET:

$paths = 'HKLM:\SOFTWARE\Microsoft\.NETFramework\v4.0.30319',
         'HKLM:\SOFTWARE\WOW6432Node\Microsoft\.NETFramework\v4.0.30319'
foreach ($p in $paths) {
  New-ItemProperty -Path $p -Name 'SchUseStrongCrypto' -Value 1 -PropertyType DWord -Force | Out-Null
  New-ItemProperty -Path $p -Name 'SystemDefaultTlsVersions' -Value 1 -PropertyType DWord -Force | Out-Null
}

For apps targeting .NET Framework 3.5, set the same values under the v2.0.50727 keys.

Step 3: WinHTTP (Server 2012 and 2008 R2 Only)

On these older versions, apps using WinHTTP need the DefaultSecureProtocols value (after installing the related Microsoft update). Set DefaultSecureProtocols = 0x800 (TLS 1.2) or 0xA00 (TLS 1.1 and 1.2) under HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\WinHttp and the WOW6432Node equivalent. Newer server versions already default to TLS 1.2.

Step 4: Restart and Verify

1. Restart the server.
2. Test an outbound connection in PowerShell:

   [Net.ServicePointManager]::SecurityProtocol
   Invoke-WebRequest https://www.example.com -UseBasicParsing | Select-Object StatusCode

3. For inbound services such as IIS, test from another machine with a TLS scanner, or check Event Viewer > System for SChannel errors.

Disabling Older Protocols (Optional)

Once everything works over TLS 1.2, you can disable TLS 1.0 and 1.1 by creating the matching keys with Enabled = 0 and DisabledByDefault = 1. Do this carefully: older clients, SQL Server versions, and legacy apps may lose connectivity. Some admins use a GUI tool to manage SChannel settings; review its template before applying.

Frequently Asked Questions

Do I need to enable TLS 1.2 on Server 2019 or 2022?

No, it’s enabled by default. You may still need the .NET settings for older applications.

Does this affect Remote Desktop?

RDP supports TLS 1.2 on current versions. If you disable older protocols, make sure RDP clients are up to date.

What about SQL Server?

Older SQL Server versions need updates to support TLS 1.2. Apply them before disabling TLS 1.0/1.1.

Summary

1. Set SChannel TLS 1.2 Server and Client keys: Enabled 1, DisabledByDefault 0.
2. Set SchUseStrongCrypto and SystemDefaultTlsVersions to 1 for .NET.
3. Configure WinHTTP on 2012 and 2008 R2.
4. Restart and test before disabling older protocols.