Richard M. Hicks richardhicks

Founder and principal consultant at Richard M. Hicks Consulting, Inc. Specialize in enterprise mobility and security infrastructure.

richardhicks / Optimize-DomainControllerTlsCipherSuites.ps1

Last active March 22, 2024 18:53

Disable Insecure TLS Cipher Suites for LDAPS on Domain Controllers

	# This Gist is a PowerShell script to set the SSL Cipher Suite Order Group Policy Object (GPO) for Windows Server 2016 and 2019/2022.
	# Reference: https://www.dsinternals.com/en/active-directory-domain-controller-tls-ldaps/

	# Security optmized cipher suite list for Windows Server 2019/2022
	$Ciphers2022 = 'TLS_AES_256_GCM_SHA384,TLS_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256'

	# Security optmized cipher suite list for Windows Server 2016
	$Ciphers2016 = 'TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256'

	$GpoName = 'Domain Controller Security Baseline'