Disable Weak Ciphers

README.md

#Requires -Version 4
#Requires -RunAsAdministrator

$Protocols = @('PCT 1.0','SSL 2.0','SSL 3.0','TLS 1.0') # Leaving 'TLS 1.1' and 'TLS 1.2'
$Hashes    = @('MD5','SHA') # SHA1 that is, leaving 'SHA 256', 'SHA 384', and 'SHA 512' 
$Ciphers   = @(
    'DES 56/56'
    'RC2 40/128','RC2 56/128','RC2 128/128'
    'RC4 40/128','RC4 56/128','RC4 64/128','RC4 128/128'
    'Triple DES 168'
) # which leaves 'AES 128/128' and 'AES 256/256'
$RegKey    = 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL'

$Protocols | % {
    New-Item -Path "$RegKey\Protocols\$_" -Name 'Client' -ItemType directory -Force
    New-ItemProperty -Path "$RegKey\Protocols\$_\Client" -PropertyType DWORD -Name 'DisabledByDefault' -Value 1 -Force
    New-Item -Path "$RegKey\Protocols\$_" -Name 'Server' -ItemType directory -Force
    New-ItemProperty -Path "$RegKey\Protocols\$_\Server" -PropertyType DWORD -Name 'DisabledByDefault' -Value 1 -Force
}

$Hashes | % {
    New-Item -Path "$RegKey\Hashes" -Name $_ -ItemType directory -Force
    New-ItemProperty -Path "$RegKey\Hashes\$_" -PropertyType DWORD -Name 'Enabled' -Value 0 -Force
}

$Ciphers | % {
    if ($_ -match '/') { $Name = "$($_.Split('/')[0])$([char]0x2215)$($_.Split('/')[1])" } else { $Name = $_ } 
    New-Item -Path "$RegKey\Ciphers" -Name $Name -ItemType directory -Force
    New-ItemProperty -Path "$RegKey\Ciphers\$Name" -PropertyType DWORD -Name 'Enabled' -Value 0 -Force
}