Azure Virtual Machines
An Azure service that is used to provision Windows and Linux virtual machines.
Azure Advisor - Windows servers should be configured to use secure communication protocols - not clear what to do - Support request
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(48, 89%, 14%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EBT%3C/text%3E%3C/svg%3E)
Biuro Technika
20
Reputation points
Good morning everyone,
In Azure Advisor I received a recommendation "Windows servers should be configured to use secure communication protocols" which description is not clear.
Description:
To ensure your windows server is using secure communication protocol:
- Enable Guest Configuration extension and system assigned identity: https://docs.microsoft.com/azure/virtual-machines/extensions/guest-configuration - This is done. Azure Policy for Windows installed on all VM's in Azure.
- Enable TLS on your machine. For Windows Server 2008 R2, Windows Server 2012, or Windows 7, install the update at https://support.microsoft.com/help/3140245. For Windows 2012 R2 Server or later, no updates are necessary. - This is done by itself as all VMs in Azure are Windows Server 2019+.
- Update the Windows and WinHTTP registry keys (or verify that they're correct) according to the information here: https://docs.microsoft.com/dotnet/framework/network-programming/tls#configuring-schannel-protocols-in-the-windows-registry. - This point is 100% not clear. A lot of developer style "hard to understand random code parts and ad-hoc paragraphs od text, a lot of mixed topic in one link. No step by step explanation of what to do exactly to fulfill this point. Could anyone describe what exactly needs to be done in this step ?
Thank you upfront!
Azure Virtual Machines
-
Biuro Technika 20 Reputation points
2025-11-04T19:47:49.3333333+00:00 Would that REGEDIT script there would be enough?
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft.NETFramework\v2.0.50727]
"SystemDefaultTlsVersions"=dword:00000001
"SchUseStrongCrypto"=dword:00000001
[HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft.NETFramework\v4.0.30319]
"SystemDefaultTlsVersions"=dword:00000001
"SchUseStrongCrypto"=dword:00000001
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft.NETFramework\v2.0.50727]
"SystemDefaultTlsVersions"=dword:00000001
"SchUseStrongCrypto"=dword:00000001
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft.NETFramework\v4.0.30319]
"SystemDefaultTlsVersions"=dword:00000001
"SchUseStrongCrypto"=dword:00000001
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(236.8, 68%, 32%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EBY%3C/text%3E%3C/svg%3E)
Bharath Y P 10,610 Reputation points Microsoft External Staff Moderator2025-11-06T10:48:49.29+00:00 Hello Biuro Technika,
It looks like you’re dealing with a recommendation from Azure Advisor to configure your Windows servers for secure communication protocols, and you're particularly unsure about the registry keys related to TLS.
A similar question has been answered in another thread that addresses the same issue. Could you please check the below thread for the detailed solution. See if you can able to resolve the you issue.
Hope this help, if you need further assistance, please let us know, thanks
-
Bharath Y P 10,610 Reputation points Microsoft External Staff Moderator
2025-11-07T17:03:07.0066667+00:00 Hello Biuro Technika, kindly let us know if the solution provided worked for you. If you need any further assistance, please feel free to reach out. Thanks,
-
Bharath Y P 10,610 Reputation points Microsoft External Staff Moderator
2025-11-10T17:33:27.3933333+00:00 Hello Biuro Technika, kindly let us know if the solution provided worked for you. If you need any further assistance, please feel free to reach out. Thanks,
-
Biuro Technika 20 Reputation points
2025-11-11T23:28:10.15+00:00 Hi Bharath, Thank you for your suggestions. Yes, I can confirm this question is related to Azure Advisor recommendations. I observed a delay in the Azure Portal - recommendation recalculation/update. I'll check it during next days and let you know if it works or not.
-
Biuro Technika 20 Reputation points
2025-11-12T18:56:53.84+00:00 4.Hi @Bharath Y P , as I checked the solution you specified below and in the related link doesn't work. Details:
- The solution is not meaningful (as on original Microsoft documentation specified by Microsoft in Azure Portal next to this recommendation "Windows servers should be configured to use secure communication protocols".
- The steps like this "Open the Registry Editor (
regedit), Navigate toHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Cryptography\Configuration\. , check for keys related to your current protocols. You may need to create keys forTLS 1.2if they don’t exist. , Here’s a reference for the necessary changes you would typically make - in theProtocolsbranch, create keys forTLS 1.2, and within that, create keys namedClientandServer. Set theDWORDvalues forEnabledto1andDisabledByDefaultto0. " are not meaningful. No information which it should be under "Configuration", what registry keys in details "create TLS 1.2 keys is not meaningful at all" (it should be specified what keys exactly and where exactly) etc. - When I opened this registry key "
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Cryptography\Configuration\"on Windows Server 2019 servers - all of them - there is nothing under the specified registry (screen attached) - The link from Azure Portal -> Advisor -> Security -> https://learn.microsoft.com/en-us/dotnet/framework/network-programming/tls#configuring-schannel-protocols-in-the-windows-registry is very chaotic and random - it contains multiple random paragraphs so it is impossible to assess what needs to be done there to fulfill the requirement of this recommendation.
Could you tell me if there is some clear documentation with the exact steps in details of what and where to configure to fulfill this Microsoft recommendation as specified in the subject?
-
Biuro Technika 20 Reputation points
2025-11-12T19:01:11.7466667+00:00 Hi, Unfortunately this answer there doesn't work. It is not meaningful. It presents the overall ideas but not what to do exactly in details. There is nothing besides multiple other folders under specified registry key "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Cryptography\Configuration" on Windows Server 2019 servers. Maybe on old version like 2008 or 2012 something is there but not on 2019. Screen attached above.
-
Biuro Technika 20 Reputation points
2025-11-12T19:03:03.1133333+00:00 Do you know if Microsoft has some clear manual of how to solve this point with exact information of what & where to configure on Windows Server 2019 servers ?
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(128, 8%, 22%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EA%3C/text%3E%3C/svg%3E)
Anonymous2025-11-13T13:59:57.2266667+00:00 -
Biuro Technika 20 Reputation points
2025-11-15T20:57:21.83+00:00 @Anonymous I've sent you a response to your private message. Did you get it or should I send it again ?
Sign in to comment
Sign in to answer