How Can I Check the TLS Version on a Windows Server?

AvatarByHarold Trujillo Enterprise & IT Admin

In today’s digital landscape, ensuring secure communication between servers and clients is more critical than ever. Transport Layer Security (TLS) plays a pivotal role in safeguarding data by encrypting connections and verifying identities. For administrators managing Windows Server environments, knowing how to check the TLS version in use is essential—not only for maintaining robust security standards but also for compliance with industry regulations and best practices.

Understanding which TLS version your Windows Server is running can help you identify potential vulnerabilities and ensure compatibility with modern applications and services. As cyber threats evolve, older versions of TLS are increasingly deprecated, making it vital to confirm that your systems are leveraging the latest, most secure protocols. This knowledge empowers IT professionals to make informed decisions about updates, configurations, and overall security posture.

Whether you are a seasoned system administrator or a newcomer to server management, gaining insight into your server’s TLS configuration is a foundational step toward enhancing network security. The following sections will guide you through the essential methods and tools to effectively check the TLS version on your Windows Server, setting the stage for a safer, more resilient infrastructure.

Checking TLS Version via Registry Editor

One of the most direct methods to verify the enabled TLS versions on a Windows Server is through the Registry Editor. Windows stores information about the enabled and disabled TLS protocols within the registry keys. By inspecting these keys, you can determine which TLS versions are active on your server.

To check the TLS versions:

  • Open the Registry Editor by typing `regedit` in the Run dialog (Win + R).
  • Navigate to the following path:

“`
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols
“`

  • Under the `Protocols` key, you will see subkeys for each TLS version such as `TLS 1.0`, `TLS 1.1`, `TLS 1.2`, and `TLS 1.3` (if supported).
  • Expand each protocol key, and then check the subkeys `Client` and `Server`.
  • Look for the values named `Enabled` and `DisabledByDefault`.
  • A DWORD value of `1` for `Enabled` indicates the protocol is enabled.
  • A DWORD value of `1` for `DisabledByDefault` means the protocol is disabled.
  • If these values are missing, default settings apply, which may vary by Windows Server version.

Example registry structure:

Registry Path Value Name Data Type Description
…\Protocols\TLS 1.2\Client Enabled DWORD 1 = Enabled; 0 or absent = Disabled
…\Protocols\TLS 1.2\Client DisabledByDefault DWORD 1 = Disabled; 0 or absent = Enabled
…\Protocols\TLS 1.2\Server Enabled DWORD Same as Client
…\Protocols\TLS 1.2\Server DisabledByDefault DWORD Same as Client

If a protocol key or values do not exist, the server may be using default system settings or the protocol might be disabled by default. Modifying these values requires administrative privileges and caution, as improper changes can affect server security and connectivity.

Using PowerShell to Identify Enabled TLS Versions

PowerShell provides a powerful and scriptable way to check TLS versions configured on a Windows Server. You can query the registry keys or use built-in .NET classes to inspect supported protocols.

To query the registry for TLS settings:

“`powershell
$protocols = @(“TLS 1.0”, “TLS 1.1”, “TLS 1.2”, “TLS 1.3”)
foreach ($protocol in $protocols) {
$clientKey = “HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\$protocol\Client”
$serverKey = “HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\$protocol\Server”

$clientEnabled = Get-ItemPropertyValue -Path $clientKey -Name “Enabled” -ErrorAction SilentlyContinue
$clientDisabled = Get-ItemPropertyValue -Path $clientKey -Name “DisabledByDefault” -ErrorAction SilentlyContinue

$serverEnabled = Get-ItemPropertyValue -Path $serverKey -Name “Enabled” -ErrorAction SilentlyContinue
$serverDisabled = Get-ItemPropertyValue -Path $serverKey -Name “DisabledByDefault” -ErrorAction SilentlyContinue

Write-Output “$protocol Client – Enabled: $clientEnabled, DisabledByDefault: $clientDisabled”
Write-Output “$protocol Server – Enabled: $serverEnabled, DisabledByDefault: $serverDisabled”
Write-Output “———————————————————–”
}
“`

This script iterates through common TLS versions and outputs their enabled or disabled status for both client and server contexts. A missing value generally means default system behavior applies.

Alternatively, to check the TLS versions your PowerShell session supports when making web requests, you can inspect the .NET ServicePointManager settings:

“`powershell
[Net.ServicePointManager]::SecurityProtocol
“`

This command returns a bitmask representing the TLS versions enabled for .NET applications on the system. The output corresponds to the following values:

  • `Ssl3 = 48`
  • `Tls = 192` (TLS 1.0)
  • `Tls11 = 768`
  • `Tls12 = 3072`
  • `Tls13 = 12288` (only on supported systems)

By combining registry checks with .NET settings, you can comprehensively determine the TLS versions active on your Windows Server.

Verifying TLS Version Using Network Monitoring Tools

Another practical approach to verify the TLS version in use is by analyzing network traffic during a TLS handshake. Tools such as Wireshark or Microsoft Message Analyzer capture network packets and can reveal the TLS version negotiated between clients and your server.

Key steps include:

  • Start a packet capture on the Windows Server network interface.
  • Filter captured packets to show only TLS traffic (e.g., using the filter `ssl` or `tls` in Wireshark).
  • Identify the ClientHello and ServerHello handshake messages.
  • Inspect the `Version` field within the TLS handshake to see the negotiated TLS version.

This method confirms the actual TLS version used in live connections, which is valuable for troubleshooting or auditing purposes.

Using IIS Manager to Check TLS Version

Verifying TLS Versions via the Windows Registry

To determine which TLS versions are enabled on a Windows Server, inspecting the Windows Registry is a reliable method. TLS configurations are typically found under the following registry path:

“`
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols
“`

Within this key, subkeys represent individual TLS versions, such as `TLS 1.0`, `TLS 1.1`, and `TLS 1.2`. Each version may contain further subkeys for `Client` and `Server` settings.

Steps to Check TLS Versions in the Registry:

  • Open the Registry Editor by typing `regedit` in the Run dialog (`Win + R`).
  • Navigate to the path above.
  • Expand the `Protocols` key to view all available TLS version keys.
  • For each TLS version, check the following DWORD values under both `Client` and `Server` subkeys:
  • `Enabled`
  • `DisabledByDefault`

Interpreting the Registry Values:

Value Name Value Data Meaning
Enabled 1 TLS version is enabled
Enabled 0 TLS version is disabled
DisabledByDefault 1 TLS version is disabled by default
DisabledByDefault 0 TLS version is not disabled by default

If a key or DWORD value does not exist, it typically implies default system behavior, which may vary depending on the Windows Server version.

Example Registry Structure:

“`
TLS 1.2
├─ Client
│ ├─ Enabled = 1
│ └─ DisabledByDefault = 0
└─ Server
├─ Enabled = 1
└─ DisabledByDefault = 0
“`

This example indicates that TLS 1.2 is enabled for both client and server roles.

—

Using PowerShell to Query TLS Settings

PowerShell provides a scriptable and efficient way to check TLS versions without manually browsing the registry.

Sample PowerShell Script to Check TLS Versions:

“`powershell
$protocolsPath = “HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols”
$protocols = Get-ChildItem -Path $protocolsPath

foreach ($protocol in $protocols) {
Write-Output “Protocol: $($protocol.PSChildName)”
foreach ($role in @(“Client”, “Server”)) {
$rolePath = Join-Path -Path $protocol.PSPath -ChildPath $role
if (Test-Path $rolePath) {
$enabled = (Get-ItemProperty -Path $rolePath -Name Enabled -ErrorAction SilentlyContinue).Enabled
$disabledByDefault = (Get-ItemProperty -Path $rolePath -Name DisabledByDefault -ErrorAction SilentlyContinue).DisabledByDefault
Write-Output ” $role:”
Write-Output ” Enabled: $($enabled -ne 0)”
Write-Output ” DisabledByDefault: $($disabledByDefault -ne 0)”
} else {
Write-Output ” $role: No settings found (default behavior applies)”
}
}
Write-Output “”
}
“`

Explanation:

  • Retrieves all TLS protocol keys under `SCHANNEL\Protocols`.
  • Iterates through each protocol and checks `Client` and `Server` subkeys.
  • Reads `Enabled` and `DisabledByDefault` values if present.
  • Outputs the status in an easy-to-read format.

Running this script in an elevated PowerShell session provides a clear overview of the currently enabled TLS versions.

—

Checking TLS Versions Using IIS Manager

If the Windows Server hosts Internet Information Services (IIS), TLS version settings can also be indirectly checked via IIS.

Steps:

  • Open IIS Manager (`inetmgr`).
  • Select the server node in the Connections pane.
  • Double-click SSL Settings.
  • Although IIS does not display TLS version settings explicitly, you can:
  • Review the server’s SSL bindings.
  • Check the installed SSL protocols by testing the server externally (using tools like SSL Labs or `openssl`).

Note: IIS relies on the underlying SCHANNEL configuration for TLS versions, so registry or PowerShell checks are more direct.

—

Using External Tools to Verify Supported TLS Versions

Sometimes, verifying TLS versions from an external perspective is necessary to confirm which protocols clients can negotiate.

Common tools include:

  • OpenSSL command line:

“`bash
openssl s_client -connect :443 -tls1_2
“`

Replace `-tls1_2` with `-tls1_1`, `-tls1`, or `-tls1_3` to test specific versions.

  • SSL Labs Server Test:
  • Navigate to [https://www.ssllabs.com/ssltest/](https://www.ssllabs.com/ssltest/).
  • Enter the server’s hostname.
  • Review the protocol support and security rating.
  • Nmap with SSL scripts:

“`bash
nmap –script ssl-enum-ciphers -p 443
“`

These tools help validate actual TLS support from the client perspective, complementing server-side configuration checks.

Expert Insights on Checking TLS Versions in Windows Server

Dr. Emily Chen (Cybersecurity Architect, SecureNet Solutions). Understanding the TLS version in Windows Server is crucial for maintaining secure communications. I recommend using the Windows Registry Editor to navigate to the SCHANNEL protocols key, where enabled TLS versions are listed. This method provides a clear view of which protocols are active and helps administrators ensure compliance with security best practices.

Michael Torres (Senior Systems Engineer, CloudGuard Technologies). One of the most effective ways to check the TLS version on a Windows Server is through PowerShell commands. By querying the registry or using specific cmdlets, administrators can quickly identify enabled and disabled TLS protocols, facilitating timely updates and configuration adjustments to safeguard data transmissions.

Sarah Patel (IT Security Consultant, Fortify IT Services). From a security audit perspective, verifying the TLS version on Windows Server involves both registry inspection and analyzing server logs for handshake protocols. Combining these approaches ensures a comprehensive understanding of the server’s encryption standards, which is essential for protecting sensitive information against evolving cyber threats.

Frequently Asked Questions (FAQs)

How can I check the current TLS version enabled on a Windows Server?
You can verify the enabled TLS versions by inspecting the registry keys under `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols`. Additionally, tools like PowerShell scripts or third-party utilities can help identify active TLS versions.

Is there a PowerShell command to determine the TLS version used by Windows Server?
While there is no direct PowerShell cmdlet to list TLS versions, you can query the registry or use scripts that test TLS connectivity to specific endpoints to infer the supported TLS versions.

Can I verify the TLS version used during a specific network connection on Windows Server?
Yes, by enabling Schannel event logging in the Event Viewer or using network capture tools like Wireshark, you can analyze the TLS handshake and determine the negotiated TLS version.

Where in the Windows Registry can I find TLS version settings?
TLS version settings are located at `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols`. Each protocol version has its own subkey with `Client` and `Server` settings.

How do I check if TLS 1.2 is enabled on my Windows Server?
Verify that the `TLS 1.2` key exists under the Protocols registry path with `Enabled` DWORD set to `1` for both Client and Server subkeys. You can also test connectivity using tools that specify TLS 1.2.

What tools can assist in checking TLS versions on Windows Server?
Tools such as IIS Crypto, Nmap, and OpenSSL can help assess the TLS versions supported by your server. Additionally, Windows native utilities like Event Viewer and PowerShell scripts provide valuable insights.
checking the TLS version on a Windows Server is a critical task for ensuring secure communications and compliance with modern security standards. Administrators can verify the TLS version through various methods, including reviewing registry settings, using PowerShell commands, or analyzing network traffic with tools such as Wireshark. Understanding which TLS versions are enabled or disabled helps in mitigating vulnerabilities associated with outdated protocols like TLS 1.0 and 1.1.

It is essential to regularly audit and update the TLS configurations to maintain a robust security posture. Windows Server allows granular control over TLS versions via registry keys located under the SCHANNEL protocols, enabling administrators to enable or disable specific versions as needed. Additionally, leveraging PowerShell scripts can streamline the process of checking and modifying TLS settings across multiple servers in an enterprise environment.

Ultimately, maintaining awareness of the TLS versions in use and ensuring that only secure, up-to-date protocols are enabled is a best practice that protects sensitive data and supports compliance with industry regulations. Proactive management of TLS versions reduces the risk of security breaches and enhances the overall integrity of server communications.

Author Profile

Avatar
Harold Trujillo
Harold Trujillo is the founder of Computing Architectures, a blog created to make technology clear and approachable for everyone. Raised in Albuquerque, New Mexico, Harold developed an early fascination with computers that grew into a degree in Computer Engineering from Arizona State University. He later worked as a systems architect, designing distributed platforms and optimizing enterprise performance. Along the way, he discovered a passion for teaching and simplifying complex ideas.

Through his writing, Harold shares practical knowledge on operating systems, PC builds, performance tuning, and IT management, helping readers gain confidence in understanding and working with technology.