Enforce TLS 1.2 for Operations Manager

This article describes how to allow System Center Operations Manager to utilize Transport Layer Security (TLS) 1.2.

1. Install Microsoft OLE DB Driver for SQL version 18.7.4 on all management servers and the web console server.

2. Install Microsoft ODBC Driver for SQL version 17.10.6 on all management servers and the web console server.

3. Configure Windows to only use TLS 1.2.

4. Configure .NET Framework to utilize higher levels of cryptography by default.

5. Configure Audit Collection Services if installed.

Note

If utilizing SQL Server connection encryption, install these driver versions instead:

• Microsoft OLE DB Driver 19: https://aka.ms/downloadmsoledbsql
• Microsoft ODBC Driver 18: https://aka.ms/downloadmsodbcsql

More information about configuring SQL connection encryption can be found here: Configure SQL Server Database Engine for encrypting connections

Configure Windows Operating System to only use TLS 1.2 protocol

Use one of the following methods to configure Windows to use only the TLS 1.2 protocol.

Method 1: Modify the registry manually

Important

Follow the steps in this section carefully. Serious problems might occur if the registry is modified incorrectly. Before making changes, back up the registries in case problems occur.

For more information, see: How to back up and restore the registry in Windows

Use the following steps to modify SChannel protocols system-wide. We recommend explicitly enabling the TLS 1.2 protocol.

Note

Making these registry changes doesn't affect the use of Kerberos or NTLM protocols.

1. Sign in to the server by using an account that has local administrative credentials.

2. Start Registry Editor by selecting and holding Start, enter regedit in the Run textbox, and select OK.

3. Locate the following registry subkey:

   HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols

4. Create a subkey under Protocols for:

   • SSL 2.0
   • SSL 3.0
   • TLS 1.0
   • TLS 1.1
   • TLS 1.2

5. Create a Client and Server subkey under each protocol version subkey created earlier. For example, the subkey for TLS 1.0 would be

   • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Client
   • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server

6. To disable a protocol, create the following DWORD values under Server and Client:

   • Enabled [Value = 0]
   • DisabledByDefault [Value = 1]

7. To explicitly enable the TLS 1.2 protocol (default is enabled), create the following registry keys:

   • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client
   • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server

8. Then create the following DWORD values under Server and Client:

   • Enabled [Value = 1]
   • DisabledByDefault [Value = 0]

9. Close the Registry Editor.

Method 2: Modify the registry with PowerShell

Run the following Windows PowerShell script as Administrator to configure the Windows Operating System to use the TLS 1.2 Protocol:

$ProtocolList       = @("SSL 2.0", "SSL 3.0", "TLS 1.0", "TLS 1.1", "TLS 1.2")
$ProtocolSubKeyList = @("Client", "Server")
$DisabledByDefault  = "DisabledByDefault"
$registryPath       = "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\"

foreach ($Protocol in $ProtocolList)
{
    foreach ($key in $ProtocolSubKeyList)
    {
        $currentRegPath = $registryPath + $Protocol + "\" + $key
        Write-Output "Current Registry Path: `"$currentRegPath`""

  if (!(Test-Path $currentRegPath))
  {
    Write-Output " `'$key`' not found: Creating new Registry Key"
    New-Item -Path $currentRegPath -Force | out-Null
  }
  if ($Protocol -eq "TLS 1.2")
  {
    Write-Output " Explicitly enable TLS 1.2 (default is enabled)"
    New-ItemProperty -Path $currentRegPath -Name $DisabledByDefault -Value "0" -PropertyType DWORD -Force | Out-Null
    New-ItemProperty -Path $currentRegPath -Name 'Enabled' -Value "1" -PropertyType DWORD -Force | Out-Null
  }
  else
  {
    Write-Output " Disabling - $Protocol"
    New-ItemProperty -Path $currentRegPath -Name $DisabledByDefault -Value "1" -PropertyType DWORD -Force | Out-Null
    New-ItemProperty -Path $currentRegPath -Name 'Enabled' -Value "0" -PropertyType DWORD -Force | Out-Null
  }
  Write-Output " "
}

Configure .NET Framework to use higher levels of cryptography

.NET Framework typically requires the application to define what TLS protocol to use for communication. In the instance of Operations Manager however, we need to tell .NET Framework system-wide which protocol to use.

After completing the configuration of all prerequisites for Operations Manager, perform the following steps on all Operations Manager servers, and on any Windows agents.

Important

Follow the steps in this section carefully. Serious problems might occur if the registry is modified incorrectly. Before making changes, back up the registries in case problems occur.

For more information, see: How to back up and restore the registry in Windows

Method 1: Modify the registry manually

1. Open the Registry Editor
2. Locate the following registry subkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v2.0.50727
   1. Create the following DWORD value pairs:
      • SchUseStrongCrypto [Value = 1]
      • SystemDefaultTlsVersions [Value = 1]
3. Locate the following registry subkey: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\.NETFramework\v2.0.50727
   1. Create the following DWORD value pairs:
      • SchUseStrongCrypto [Value = 1]
      • SystemDefaultTlsVersions [Value = 1]
4. Locate the following registry subkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319
   1. Create the following DWORD value pairs:
      • SchUseStrongCrypto [Value = 1]
      • SystemDefaultTlsVersions [Value = 1]
5. Locate the following registry subkey: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\.NETFramework\v4.0.30319
   1. Create the following DWORD value pairs:
      • SchUseStrongCrypto [Value = 1]
      • SystemDefaultTlsVersions [Value = 1]
6. Restart the system for the settings to take effect.

Method 2: Modify the registry with PowerShell

Run the following Windows PowerShell script in Administrator mode to automatically configure .NET Framework to prevent framework-inherited TLS 1.0 dependencies:

# Allow .NET Framework to use higher levels of Cryptography
$NetRegistryPath1 = "HKLM:\SOFTWARE\WOW6432Node\Microsoft\.NETFramework\v2.0.50727" 
New-ItemProperty -Path $NetRegistryPath1 -Name "SchUseStrongCrypto" -Value "1" -PropertyType DWORD -Force | Out-Null 
New-ItemProperty -Path $NetRegistryPath1 -Name "SystemDefaultTlsVersions" -Value "1" -PropertyType DWORD -Force | Out-Null

$NetRegistryPath2 = "HKLM:\SOFTWARE\WOW6432Node\Microsoft\.NETFramework\v4.0.30319" 
New-ItemProperty -Path $NetRegistryPath2 -Name "SchUseStrongCrypto" -Value "1" -PropertyType DWORD -Force | Out-Null
New-ItemProperty -Path $NetRegistryPath2 -Name "SystemDefaultTlsVersions" -Value "1" -PropertyType DWORD -Force | Out-Null

$NetRegistryPath3 = "HKLM:\SOFTWARE\Microsoft\.NETFramework\v2.0.50727" 
New-ItemProperty -Path $NetRegistryPath3 -Name "SchUseStrongCrypto" -Value "1" -PropertyType DWORD -Force | Out-Null 
New-ItemProperty -Path $NetRegistryPath3 -Name "SystemDefaultTlsVersions" -Value "1" -PropertyType DWORD -Force | Out-Null

$NetRegistryPath4 = "HKLM:\SOFTWARE\Microsoft\.NETFramework\v4.0.30319" 
New-ItemProperty -Path $NetRegistryPath4 -Name "SchUseStrongCrypto" -Value "1" -PropertyType DWORD -Force | Out-Null
New-ItemProperty -Path $NetRegistryPath4 -Name "SystemDefaultTlsVersions" -Value "1" -PropertyType DWORD -Force | Out-Null

Additional settings

If monitoring a supported version of Linux server with Operations Manager, follow the instructions on the appropriate website for your distro to configure TLS 1.2.

Audit Collection Services

For Audit Collection Services (ACS), additional changes must be made in the registry on ACS Collector server. ACS uses the ODBC Data Source Name (DSN) to make connections to the database. Ensure the DSN settings are updated to make them functional for TLS 1.2.

1. Sign in to the server by using an account that has local administrative credentials.

2. Start Registry Editor by selecting and holding Start, enter regedit in the Run textbox, and select OK.

3. Locate the following ODBC subkey for OpsMgrAC: HKEY_LOCAL_MACHINE\SOFTWARE\ODBC\ODBC.INI\OpsMgrAC.

   Note

   The default name of DSN is OpsMgrAC.

4. Under ODBC Data Sources subkey, select the DSN name OpsMgrAC. This contains the name of the ODBC driver to be used for the database connection. If ODBC 17 is installed, change this name to ODBC Driver 17 for SQL Server.

5. Under the OpsMgrAC subkey, update the Driver for the ODBC version that is installed.

   • For example, if ODBC 17 is installed, change the Driver entry to %WINDIR%\system32\msodbcsql17.dll.
   • Check the name of the DLL for the current version of the ODBC driver installed if different.

Registry File

Alternatively, create and save the following .reg file in Notepad or another text editor. To run the saved .reg file, double-click the file.

• For ODBC 17, create the following ODBC 17.reg file:

  Windows Registry Editor Version 5.00
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\ODBC\ODBC.INI\ODBC Data Sources]
  "OpsMgrAC"="ODBC Driver 17 for SQL Server"
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\ODBC\ODBC.INI\OpsMgrAC]
  "Driver"="%WINDIR%\system32\msodbcsql17.dll"
  

PowerShell

Alternatively, run the following PowerShell commands to automate the change.

• Ensure to replace the dll file path to an appropriate version if using an ODBC driver version other than 17.

  New-ItemProperty -Path "HKLM:\SOFTWARE\ODBC\ODBC.INI\OpsMgrAC" -Name "Driver" -Value "%WINDIR%\system32\msodbcsql7.dll" -PropertyType STRING -Force | Out-Null
  New-ItemProperty -Path "HKLM:\SOFTWARE\ODBC\ODBC.INI\ODBC Data Sources" -Name "OpsMgrAC" -Value "ODBC Driver 17 for SQL Server" -PropertyType STRING -Force | Out-Null
  

Next steps

• For more information about TLS 1.0 from our Security Engineering team, see Solving the TLS 1.0 Problem.
• For a complete listing of ports used, the direction of the communication, and if the ports can be configured, see Configuring a Firewall for Operations Manager.
• For an overall review of how data between components in a management group is protected, see Authentication and Data Encryption in Operations Manager.