POWERSHELL: Get a machines TLS settings

GetTLSSettings.ps1

Clear-Host

function Def($v) { if ($null -ne $v) { $v } else { 'not set' } }

# Enabled TLS protocols (OS/SCHANNEL level)
'TLS 1.0','TLS 1.1','TLS 1.2','TLS 1.3' | ForEach-Object {
    $p = "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\$_\Client"
    $en = (Get-ItemProperty $p -Name Enabled -ErrorAction SilentlyContinue).Enabled
    $dd = (Get-ItemProperty $p -Name DisabledByDefault -ErrorAction SilentlyContinue).DisabledByDefault
    "{0,-8} Enabled={1} DisabledByDefault={2}" -f $_, (Def $en), (Def $dd)
}

# What .NET / SqlClient will actually negotiate in this session
"Default .NET protocols: $([Net.ServicePointManager]::SecurityProtocol)"

# .NET strong-crypto flags (affects apps that use system defaults)
'HKLM:\SOFTWARE\Microsoft\.NETFramework\v4.0.30319',
'HKLM:\SOFTWARE\WOW6432Node\Microsoft\.NETFramework\v4.0.30319' | ForEach-Object {
    $s = (Get-ItemProperty $_ -Name SchUseStrongCrypto -ErrorAction SilentlyContinue).SchUseStrongCrypto
    "$_  SchUseStrongCrypto=$(Def $s)"
}

GetTLSSettings.sql

SET NOCOUNT ON;

-- ============ 1) TLS protocol settings (host-level) ============
DECLARE @tls TABLE (protocol sysname, role sysname, status VARCHAR(20), DisabledByDefault VARCHAR(20));
DECLARE @path NVARCHAR(400), @prot sysname, @role sysname, @enabled INT, @disabled INT;

DECLARE cur CURSOR FOR
SELECT prot, role
FROM (VALUES ('TLS 1.0'),('TLS 1.1'),('TLS 1.2'),('TLS 1.3')) p(prot)
CROSS JOIN (VALUES ('Server'),('Client')) r(role);

OPEN cur;
FETCH NEXT FROM cur INTO @prot, @role;
WHILE @@FETCH_STATUS = 0
BEGIN
    SET @path = 'SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\' + @prot + '\' + @role;
    SET @enabled = NULL; SET @disabled = NULL;
    EXEC master..xp_instance_regread 'HKEY_LOCAL_MACHINE', @path, 'Enabled', @enabled OUTPUT;
    EXEC master..xp_instance_regread 'HKEY_LOCAL_MACHINE', @path, 'DisabledByDefault', @disabled OUTPUT;
    INSERT INTO @tls VALUES (@prot, @role,
        CASE WHEN @enabled IS NULL THEN 'not set'
             WHEN @enabled = 0 THEN 'disabled'
             ELSE 'enabled' END,
        CASE WHEN @disabled IS NULL THEN 'not set'
             WHEN @disabled = 0 THEN 'no (0)'
             ELSE 'yes (' + CAST(@disabled AS VARCHAR(10)) + ')' END);
    FETCH NEXT FROM cur INTO @prot, @role;
END
CLOSE cur; DEALLOCATE cur;

SELECT protocol, role, status, DisabledByDefault
FROM @tls ORDER BY protocol, role;

-- ============ 2) SQL Server encryption config ============
DECLARE @force INT, @cert NVARCHAR(200);
EXEC master..xp_instance_regread 'HKEY_LOCAL_MACHINE',
    'Software\Microsoft\MSSQLServer\MSSQLServer\SuperSocketNetLib', 'ForceEncryption', @force OUTPUT;
EXEC master..xp_instance_regread 'HKEY_LOCAL_MACHINE',
    'Software\Microsoft\MSSQLServer\MSSQLServer\SuperSocketNetLib', 'Certificate', @cert OUTPUT;

SELECT
    ForceEncryption = CASE WHEN @force IS NULL THEN 'not set'
                           WHEN @force = 0 THEN 'no' ELSE 'yes' END,
    CertificateThumbprint = ISNULL(@cert,'none');

-- ============ 3) Live connection encryption ============
SELECT session_id, encrypt_option, protocol_type, auth_scheme, client_net_address
FROM sys.dm_exec_connections
ORDER BY session_id;