Category Archives: Uncategorized

[Tutorial] Upgrading from ADFS 2.0 (Server 2008 R2) to ADFS 3 (Server 2012 R2)

Scenario: You want to upgrade your ADFS 2.0 or 2.1 farm using WID (Windows Internal Database) from Server 2008 R2 to Server 2012 R2. In this scenario, I have 2 ADFS servers (one as the primary and a second for failover purposes), and 2 ADFS Proxy servers (for load balancing/failover purposes).

NOTE: Prior to writing this article I had only found limited documentation provided by Microsoft on a proper upgrade path for this. Since then, it apperas that tools had been included with the Server 2012 installation media which will greatly cutdown on the number of steps needed as well as provide as little downtime as possible. I would highly recommend giving this article a read before proceeding with my article: http://blogs.technet.com/b/askpfeplat/archive/2014/03/31/how-to-build-your-adfs-lab-part4-upgrading-to-server-2012-r2.aspx

My article should still work, but it is definitely not the most efficient way to do an upgrade as pointed out in the technet article above. My guide essentially goes over cutting over to a completely new ADFS deployment “an upgrade”, side-by-side to your production environment. As pointed out below, you cannot add a Server 2012 R2 machine to a Server 2008 R2 ADFS farm as documented in their earlier help articles.

Tutorial

Login to one of your slave ADFS nodes (secondary server) running Server 2008 R2
Remove the node from your load balancer
Stop the AD FS 2.0 Windows Service
Click Start -> Administrative Tools -> Internet Information Services (IIS) Manager
Select your server and double click on Server Certificates
Right click on your certificate and select Export…
Export the certificate to your desktop, type in a password to protect the exported certificate/private key, and select OK
Copy the pfx (exported certificate/private key) to your local machine; we will import this on our new server later.
Disjoin the ADFS machine from the domain
Turn the ADFS machine off and retire it
Create a new Server 2012 R2 machine with the same name and IP as your Server 2008 R2 ADFS machine
While the new ADFS machine is being created, login to one of your ADFS proxy servers
Remove the proxy from your load balancer
Stop the AD FS 2.0 Windows Service
Turn the machine off and retire it
Create a new Server 2012 R2 machine with the same name and IP as your Server 2008 R2 ADFS Proxy machine
While the new ADFS proxy machine is being created, login to your new ADFS Server 2012 R2 machine.
Open up Server Manage and select Manage -> Add Roles and Features
On the Before You Begin screen, click Next >
Select Role-based or feature-based installation and click Next >
Select your server and click Next >
Check Active Directory Federation Services and click Next >
Click Next > on Features
Click Next > on AD FS
Click Install
Click on the Configure the federation service on this server. link once the installation has completed successfully.
Check Create the first federation server in a federation server farm on the Welcome screen for the Active Directory Federation Services Configuration Wizard and then click Next >
1. Please see my notes below on why we did not check Create the first federation server in a federation server farm.
Click Next > on the Connect to AD DS step
Copy the .pfx file we exported from the ADFS server earlier to the new ADFS server
On the Specify Service Properties screen, click on the Import… button
Select your certificate and click Open
Type in the password to the exported certificate and click OK
Type in a Federation Service Display Name that will be shown to your users when they login to the ADFS service (this can be anything), and click Next >
On the Specify Service Account screen, click the Select… button
Type in the name of your service account you wish to use for ADFS, click the Check Names button to verify you don’t have any typos, and click OK
Type in the password for the ADFS service account and click Next >
Click Next > on the Specify Configuration Database
1. Note: I choose to continue to use WID, you can switch to SQL if you would like now, however that is outside of the scope of this document.
Click Next > on the Review Options screen
Click the Configure button once all the prerequsite checks have passed successfully
Click Close once the server has successfully been configured
Open up Internet Explorer on the new ADFS machine and navigate to https://localhost/adfs/ls/IdpInitiatedSignon.aspx to ensure the service is properly running
1. Note: you should receive an invalid ssl certificate error; that is OK, we will switch the DNS records over once we are ready to transition from our old farm to the new one.
Next, login to your Server 2008 R2 primary ADFS server and recreate the federation trusts on the new Server 2012 R2 primary ADFS server
1. Start -> Administrative Tools -> AD FS 2.0 Management; select Trust Relationships -> Relying Party Trusts
2. Recreate all the rules/trusts from your original ADFS server on your new Server 2012 R2 ADFS machine
  1. Note: If you are recreating rules for Office 365, you will need to wait until you switch over our new Server 2012 R2 environment to production. The reason is when you setup the new ADFS instance, some of the certificates will change causing a certificate mismatch/preventing your users from logging in. You will need to make sure you follow the following steps when resetting up the Office 365 trust to ensure your users don’t receive “Error 80041317”: http://support.microsoft.com/kb/2647020/en-us
Login to your new ADFS Proxy server
Import your SSL cerficate from your old ADFS server (from step 8) onto the server’s Local Machine certificate store
1. Right click on Start and select Run
2. Type MMC and click OK
3. Click File -> Add/Remove Snap-in…
4. Select Certificates and click Add >
5. Select Computer account and click Next >
6. Select Finish
7. Click OK on the Add or Remove Snap-ins screen
8. Expand Certificates (Local Computer), select Personal, and right click, select All Tasks -> Import…
9. Click Next on the Certificate Import Wizard
10. Click the Browse… button
11. Select your certificate and click Open
  1. Note: You may need to click on the dropdown box in the bottom right and select All Files for your pfx file to show up.
12. Click Next on the File to Import screen
13. Type in the password to the pfx file, check Mark this key as exportable, and click Next
14. Ensure Place all certificates in the following store shows Personal and click Next
15. Click Finish
16. Click OK on the Certificate Import Wizard successful dialog box
Edit the hosts file to point your DNS record to your new ADFS server
1. Open Notepad as an Administrator
2. Open the following file: C:\Windows\System32\drivers\etc\hosts
3. Add in your DNS entry and point to your new ADFS server
4. Save the file
  1. Note: We will come back to this later and update it to point to our load balancer once we switch over everything. For now, this lets us test our new deployment while switching things over.
Open up Server Manager
Click Manage -> Add Roles and Features
Click Next > on the Before you begin screen
Select Role-based or feature based installation and click Next >
Select your server and click Next >
Check Remote Access on the Server Roles screen
Click Next > on the Features screen
Click Next > on the Remote Access screen
Check Web Application Proxy
ClickAdd Features on the Add Roles and Features Wizard dialog box
Click Next > on the Roles Services screen
Click Install on the Confirmation screen
Click on the Open the Web Application Proxy Wizard link once the installation succeeds
Click Next > on the Welcome screen
Type in the FQDN to your ADFS server, the credentials of an account with local admin privileges, and then click Next >
Select your certificate on the AD FS Proxy Certificate screen and click Next >
Click Configure on the Confirmation screen
Click Close once the Web Application Proxy has been successfully configured.
After you click close a new window should open. On the Remote Access Management Console, select Publish
1. Note: This step only needs to be done once. It will replicate to all other proxy servers when you set those up at a later time.
Click Next > on the Welcome screen
Select Pass-through and click Next >
Enter in a name, external URL, and internal URL for your federated server (mine were both the same since I use split-dns). Click Next >
Click Close
Add the new Server 2012 R2 ADFS machine to your load balancer and remove your Server 2008 R2 machine.
Add the new Server 2012 R2 ADFS Proxy machine to your load balancer and remove your Server 2008 R2 proxy machine.
Update the hosts file on your Server 2012 R2 proxy machine to point to your load balanced Server 2012 R2 ADFS environment
Retire your Server 2008 R2 ADFS environment
1. Disjoin the ADFS proxy server from the domain and recycle the machine
2. Open up PowerShell as an Administrator
3. Execute the following commands:
  1. Add-PsSnapin Microsoft.Adfs.Powershell
    Get-AdfsProperties
4. Stop the service on your Server 2008 R2 ADFS machine running the old ADFS farm
5. Execute the following command to remove the ADFS Farm info from AD (substituting in the information from the Get-AdfsProperties command):
  1. $delme = New-Object System.DirectoryServices.DirectoryEntry(“LDAP://CN=484e24a8-5726-4186-8e24-825b77920798,CN=ADFS,CN=Microsoft,CN=Program Data,DC=mydomain,DC=local“)
    $delme.DeleteTree()
6. Disjoin the ADFS machine from the domain and recycle the machine
Add a new Server 2012 R2 machine and WAP machine to your new ADFS environment for redudnancy (same steps as above, except in Step 27, you will select Add a federation server to federation server farm

Notes: Here is the upgrade compatibility matrix for upgrading ADFS from a specific version to Server 2012: http://technet.microsoft.com/en-us/library/jj647765.aspx

Why did I not check Add a federation server to a federation server farm on the Welcome screen for the Active Directory Federation Services Configuration Wizard?

The reason behind not checking this is I believe Microsoft has a bug in their discovery tool in adding another machine to a farm running ADFS 3.0. When adding a Server 2012 R2 machine to a farm with only Server 2008 R2 machines running ADFS 2.0, you will receive the following error:

The primary federation server was contacted successfully, but the configuration data was not valid. Ensure that the primary federation server is running Windows Server 2012 R2 or later. Unable to retrieve configuration from the primary server. The primary federation server was contacted successfully, but the configuration data was not valid. Ensure that the primary federation server is running Windows Server 2012 R2 or later. Prerequisites Check Completed One or more prerequisites failed. Please fix these issues and click “Rerun prerequisites check”

Symptom: You receive the following error while setting up the WAP (proxy) server:

An error occurred when attempting to establish a trust relationship with the federation service. Error: Not Found

Resolution: Make sure you update the DNS records of your ADFS deployment to point to your new ADFS server. Both the ADFS proxy and ADFS server must be running the same OS version (in this case, Server 2012 R2).

Error: DHCP: Credentials for DNS update should be configured if secure dynamic DNS update is enabled and the domain controller is on the same host as the DHCP server.

4 Replies

Symptom: In Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, and Windows Server 2012 R2 you receive the following Warning when running the Microsoft Best Practices Analyzer.

Severity: Error
DHCP: Credentials for DNS update should be configured if secure dynamic DNS update is enabled and the domain controller is on the same host as the DHCP server.

What does this mean?

If you have the DHCP service installed on your domain controller without a service account configured, by default, DNS registrations from DHCP clients will be prevented from being registered and will log event 1056 in event viewer.

Solution: Complete the following steps below to change the credentials of the service account used for DHCP.

Before beginning, make sure you have a service account you can use to set the DHCP Server to run as. This account should be a domain account (not a local account) and should not have any fancy privileges (standard user account, not an administrator).
Open up Server Manager
Click Tools and select DHCP
Expand your DHCP server and right click on the IPv4 service and select Properties
Select the Advanced tab and then click the Credentials… button
Enter in the User name, domain, password, and confirmation password to the user and click OK
Click OK on the IPv4 Properties screen
Repeat this step on each of the DHCP servers in your domain. It is recommended to use the same service account on each of the machines.

Notes: The official KB article from Microsoft on this subject can be found here: http://technet.microsoft.com/en-us/library/ee941181(v=ws.10).aspx
Another very good Technet article written by karammasri on this subject can be found here: http://blogs.technet.com/b/stdqry/archive/2012/04/03/dhcp-server-in-dcs-and-dns-registrations.aspx

Warning: Short file name creation should be disabled

2 Replies

Symptom: In Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, and Windows Server 2012 R2 you receive the following Warning when running the Microsoft Best Practices Analyzer.

Severity: Warning
Short file name creation should be disabled

What is short file name creation?

Back in the good ol’ days of windows, filenames were limited to a format of 8 characters for the name, a period, and then 3 characters for a file extension. The filename was limited by FAT formatted partitions. Unless running very old legacy applications, this can be safely turned off to help with performance.

Solution: Complete the following steps below to disable short file name creation.

Open up an elevated powershell console
Execute the following command
1. Set-ItemProperty -Path “HKLM:\SYSTEM\CurrentControlSet\Control\FileSystem” -Name NtfsDisable8dot3NameCreation -Value 1
Optionally, you can open up registry viewer and confirm the value has been changed.

Notes: An official KB article from Microsoft on this topic can be found here: http://technet.microsoft.com/en-us/library/ff633453(v=ws.10).aspx

Warning: Enable Receive Side Scaling (RSS) on a network adapter

Warning: All OUs in this domain should be protected from accidental deletion

1 Reply

Symptom: When running the Microsoft Best Practices Analyzer on Server 2008 – Server 2012 R2, you receive the following warning:

Severity: Warning
All OUs in this domain should be protected from accidental deletion

What is accidental deletion?

By protecting all OUs in the domain from accidental deletion, you will prevent yourself from being able to simply right click and delete an organizational unit in Active Directory Users and Groups. By enabling accidental deletion on all OUs, you will have to take an extra step to delete the OU (which can be nice, as you don’t want to accidentally delete an OU with important users or groups in it).

Solution:

Complete the steps below to enable protect all OUs in the domain from accidental deletion.

Open up Server Manager
Click Tools and select Active Directory Module for Windows PowerShell
Optional Step: Execute the following command to see which OUs are not currently protected from accidental deletion
1. Get-ADOrganizationalUnit -filter * -Properties ProtectedFromAccidentalDeletion | where {$_.ProtectedFromAccidentalDeletion -eq $false} | ft DistinguishedName
Execute the following command to protect all OUs in the domain from accidental deletion
1. Get-ADOrganizationalUnit -filter * -Properties ProtectedFromAccidentalDeletion | where {$_.ProtectedFromAccidentalDeletion -eq $false} | Set-ADOrganizationalUnit -ProtectedFromAccidentalDeletion $true

Notes: An official KB article from Microsoft on this subject can be found here: http://technet.microsoft.com/en-us/library/dd723677(v=ws.10).aspx

Warning: DNS: The DNS server should have scavenging enabled

1 Reply

Symptom: When running the Microsoft Best Practice Analyzer on Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, or Windows Server 2012 R2, you receive the following recommendation/warning:

Severity: Warning
DNS: The DNS server should have scavenging enabled.

What is DNS scavenging?

Per Microsoft: Scavenging automates the deletion of old records. When scavenging is disabled, these records must be deleted manually or the size of the DNS database can become large and have an adverse effect on performance.

Solution: Complete the following steps below to enable scavenging of DNS records.

Click Start (right click Start if in Server 2012), and select Run
Type dnsmgmt.msc and click OK
Right click on your server and select Properties
Click on the Advanced tab and check Enable automatic scavenging of stale records
Click OK

Notes: The official KB article from Microsoft can be found here: http://technet.microsoft.com/en-us/library/ff807390(v=ws.10).aspx

Enabling SSL on Windows Server Update Services (WSUS)

28 Replies

Here are the steps to configure SSL on your servers running the Windows Server Update Services. This guide was written using Server 2012 R2, however it should be the same steps for Windows Server 2008 R2 as well. This guide also assumes you have a working instance of WSUS installed and configured, using default ports.

Login to your WSUS server
Open up Server Manager
Select Tools -> Internet Information Services (IIS) Manager
Generate a SSL certificate
1. Click on your Server and select Server Certificates
2. If you have your own PKI environment, follow these steps, if not, jump to step three
  1. Click Create Domain Certificate on the right side
  2. Fill in the requested information on the Distinguished Name Properties page and click Next
  3. Select your certificate authority and enter a friendly name (this can be anything), and then click Finish
3. If you need to submit a certificate request to an external certificate authority like Goaddy, Verisgn, Comodo; follow these steps
  1. Click Create Certificate Request on the right side
  2. Fill out the Distinguished Name Properties and click Next
  3. Change the Bit length to 2048 and click Next
  4. Select a location on where to place the CSR file that will be generated by the wizard and click Finish
  5. At this point, send the request to your certificate authority (like GoDaddy, Verisign, or your own internal certificate authority). You should receive back a .cer file once the claim has been fulfilled.
  6. Click on Complete Certificate Request on the right side
  7. Select the .cer file that your public certificate authority provided you, type in a friendly name (this can be anything), select Web Hosting for the certificate store, and click OK
Next, we need to bind the SSL certificate to your network adapter.
1. Expand your server, expand Sites, and select WSUS Administration
2. Select Bindings… on the right side
3. Select the https site and hit the Edit… button
4. Select https for the type, select the SSL certificate you created above, and click OK
5. Click Close on the Site Bindings window
Next, we need to enforce SSL encryption on the following virtual roots
• ApiRemoting30
• ClientWebService
• DSSAuthWebService
• ServerSyncWebService
• SimpleAuthWebService
1. Expand WSUS Administration and foreach of the directories above, complete the following steps
  1. Select the virtual site
  2. Double click on SSL Settings
  3. Check Require SSL and leave client certificates to ignore
  4. Click Apply in the top right corner
Next, we need to execute a command to tell WSUS to use ssl
1. Open up an elevated command prompt
2. Navigate to your WSUS installation folder
  1. cd “c:\Program Files\Update Services\Tools”
3. Execute the following command (replace your server with the correct FQDN)
  1. WSUSUtil.exe configuressl myserver.mydomain.local
Restart the WSUS server to make sure all changes take effect. You should be able to bring up the WSUS management console if all went well.
Configure your clients to connect via SSL to the WSUS server via Group Policy
1. Login to your domain controller
2. Open up Server Manager
3. Open up Group Policy Management
4. Right click on the policy you want to edit and select Edit
5. Expand Computer Configuration -> Polices -> Administrative Templates -> Windows Components -> Windows Update
6. Double click on Specify intranet Microsoft update service location
7. Change the intranet update service url to https and specify port 8531 and then click Apply.

That should do it! Try doing a gpupdate /force on your local machine and the check for windows updates. If windows successfully completes checking for updates, you should be good to go! 🙂

Notes: Official documentation from Microsoft in regards to using SSL and WSUS can be found here: http://technet.microsoft.com/en-us/library/hh852346.aspx#consswsus

Windows Update Services – Multiple Errors in Event Viewer – Event ID 12052,12042, 12022, 12032, 12012, 12002,13042

11 Replies

Symptom: When browsing through the event viewer logs on your Windows Update Services server, you notice the following Event IDs with a Level of Error in the following order: 12052, 12042, 12022, 12032, 12012, 12002, 13042.

Log Name: Application
Source: Windows Server Update Services
Event ID: 12052
Task Category: 9
Level: Error
Description: The DSS Authentication Web Service is not working.

Log Name: Application
Source: Windows Server Update Services
Date: 10/3/2013 4:53:26 AM
Event ID: 12042
Task Category: 9
Level: Error
Description: The SimpleAuth Web Service is not working.

Log Name: Application
Source: Windows Server Update Services
Date: 10/3/2013 4:53:26 AM
Event ID: 12022
Task Category: 9
Level: Error
Description: The Client Web Service is not working.

Log Name: Application
Source: Windows Server Update Services
Date: 10/3/2013 4:53:26 AM
Event ID: 12032
Task Category: 9
Level: Error
Description: The Server Synchronization Web Service is not working.

Log Name: Application
Source: Windows Server Update Services
Date: 10/3/2013 4:53:26 AM
Event ID: 12012
Task Category: 9
Level: Error
Description: The API Remoting Web Service is not working.

Log Name: Application
Source: Windows Server Update Services
Date: 10/3/2013 4:53:26 AM
Event ID: 12002
Task Category: 9
Level: Error
Description: The Reporting Web Service is not working.

Log Name: Application
Source: Windows Server Update Services
Date: 10/3/2013 4:53:26 AM
Event ID: 13042
Task Category: 6
Level: Error
Description: Self-update is not working.

Additionally, you can recreate these events by running the following command: wsusutil.exe checkhealth

Solution: Reconfigure the WSUS server via the wsusutil.exe command.

Login to the WSUS server
Open up a command prompt with Administrative rights
Navigate to the Update Services\Tools directory.
1. By default you can find it on your C drive by executing the following command
  1. cd “c:\Program Files\Update Services\Tools”
Execute one of the following commands
1. If updates are configured for port 80 execute this command
  1. wsusutil.exe usecustomwebsite false
2. If updates are configured for port 8530 execute this command
  1. wsusutil.exe usecustomwebsite true
Execute the following command to verify the WSUS service is running correctly
1. wsusutil.exe checkhealth
You should see Event ID 10000 in event viewer confirming all is well

Tutorial – How to setup a KMS server for a Windows Domain

5 Replies

Copied from Microsoft, here is what we can achieve by configuring a KMS server on our local network for a windows domain: http://technet.microsoft.com/en-us/library/ff793434.aspx

KMS activates computers on a local network, eliminating the need for individual computers to connect to Microsoft. To do this, KMS uses a client–server topology. KMS client computers can locate KMS host computers by using Domain Name System (DNS) or a static configuration. KMS clients contact the KMS host by using remote procedure call (RPC). KMS can be hosted on computers that are running the Windows Vista, Windows 7, Windows Server 2003, Windows Server 2008, or Windows Server 2008 R2 operating systems.

Go to the volume licensing center and grab a copy of the KMS key for your server OS
1. Navigate to https://www.microsoft.com/Licensing/servicecenter/home.aspx
2. Login
3. Select Downloads and Keys
4. Select Windows Server
5. Finder your server version and click Key
6. Copy the KMS type key
Login to the server you want to setup as the KMS server.
Open up a command prompt as an administrator.
Ensure you are in the system32 folder of Windows
1. cd c:\Windows\System32
Execute the following command to setup your license key
1. cscript slmgr.vbs /ipk WINDOWS-KMS-LICENSE-KEY-HERE
Execute the following command to activate the host
1. cscript slmgr.vbs /ato
Execute the following command to verify the host has the Key Management Service enabled
1. cscript slmgr.vbs /dlv
Next, we need to open the firewall for the server to accept activation requests
1. Open up Windows Firewall with Advanced Security
2. Right click on Inbound Rules and select New Rule…
3. Select Port and click Next >
4. Check TCP, check Specific Local Ports and enter port 1688, click Next >
5. Check Allow the connection and click Next >
6. Check Domain and click Next >
7. Enter a name for the rule and click Finish

Congrats! Your KMS server should now be ready to accept activation requests!

Notes: Here is a full listing of the commands/switches you can execute using the Software Licensing Management Tool.

Invalid combination of command parameters.

Windows Software Licensing Management Tool
Usage: slmgr.vbs [MachineName [User Password]] [<Option>]
MachineName: Name of remote machine (default is local machine)
User: Account with required privilege on remote machine
Password: password for the previous account

Global Options:
/ipk <Product Key>
Install product key (replaces existing key)
/ato [Activation ID]
Activate Windows
/dli [Activation ID | All]
Display license information (default: current license)
/dlv [Activation ID | All]
Display detailed license information (default: current license)
/xpr [Activation ID]
Expiration date for current license state

Advanced Options:
/cpky
Clear product key from the registry (prevents disclosure attacks)
/ilc <License file>
Install license
/rilc
Re-install system license files
/rearm
Reset the licensing status of the machine
/upk [Activation ID]
Uninstall product key

/dti [Activation ID]
Display Installation ID for offline activation
/atp <Confirmation ID> [Activation ID]
Activate product with user-provided Confirmation ID

Volume Licensing: Key Management Service (KMS) Client Options:
/skms <Name[:Port] | : port> [Activation ID]
Set the name and/or the port for the KMS computer this machine will use. IPv6 address must be specified in the format [hostname]:port
/ckms [Activation ID]
Clear name of KMS computer used (sets the port to the default)
/skms-domain <FQDN> [Activation ID]
Set the specific DNS domain in which all KMS SRV records can be found. This setting has no effect if the specific single KMS host is set via /skms option.
/ckms-domain [Activation ID]
Clear the specific DNS domain in which all KMS SRV records can be found. The specific KMS host will be used if set via /skms. Otherwise default KMS auto-discovery will be used.
/skhc
Enable KMS host caching
/ckhc
Disable KMS host caching

Volume Licensing: Token-based Activation Options:
/lil
List installed Token-based Activation Issuance Licenses
/ril <ILID> <ILvID>
Remove installed Token-based Activation Issuance License
/ltc
List Token-based Activation Certificates
/fta <Certificate Thumbprint> [<PIN>]
Force Token-based Activation

Volume Licensing: Key Management Service (KMS) Options:
/sprt <Port>
Set TCP port KMS will use to communicate with clients
/sai <Activation Interval>
Set interval (minutes) for unactivated clients to attempt KMS connection. The activation interval must be between 15 minutes (min) and 30 days (max) although the default (2 hours) is recommended.
/sri <Renewal Interval>
Set renewal interval (minutes) for activated clients to attempt KMS connection. The renewal interval must be between 15 minutes (min) and 30 days (max) although the default (7 days) is recommended.
/sdns
Enable DNS publishing by KMS (default)
/cdns
Disable DNS publishing by KMS
/spri
Set KMS priority to normal (default)
/cpri
Set KMS priority to low
/act-type [Activation-Type] [Activation ID]
Set activation type to 1 (for AD) or 2 (for KMS) or 3 (for Token) or 0 (for all).

Volume Licensing: Active Directory (AD) Activation Options:
/ad-activation-online <Product Key> [Activation Object name]
Activate AD (Active Directory) forest with user-provided product key
/ad-activation-get-iid <Product Key>
Display Installation ID for AD (Active Directory) forest
/ad-activation-apply-cid <Product Key> <Confirmation ID> [Activation Object name]
Activate AD (Active Directory) forest with user-provided product key and Confirmation ID
/ao-list
Display Activation Objects in AD (Active Directory)
/del-ao <Activation Object DN | Activation Object RDN>
Delete Activation Objects in AD (Active Directory) for user-provided Activation Object

Enabling TLS 1.2 on IIS 7.5 for 256-bit cipher strength

8 Replies

So strangely enough, I always thought submitting a 2048bit CSR to my CA and receiving a 256-bit SSL cert would automatically force connections to use a 256-bit cipher strength over the established SSL connection, however it turns out that most connections will stay at 128-bit unless you tell your server to utilize TLS 1.2. In this tutorial, we will go over how to enable TLS v1.2 for IIS to increase the cipher strength to 256-bits.

Here is what a certificate’s connection info looked like before the tutorial

Here is what a certificate’s connection info looks like after the tutorial

Execute the following commands via an elevated PowerShell command prompt to enable TLS v1.2:
1. # Create keys in registry (not created by Windows out of the box) md "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2" md "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server" md "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client" # Enable TLS 1.2 for client and server SCHANNEL communications new-itemproperty -path "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server" -name "Enabled" -value 1 -PropertyType "DWord" new-itemproperty -path "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server" -name "DisabledByDefault" -value 0 -PropertyType "DWord" new-itemproperty -path "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client" -name "Enabled" -value 1 -PropertyType "DWord" new-itemproperty -path "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client" -name "DisabledByDefault" -value 0 -PropertyType "DWord"
2. Registry before powershell commands
3. Registry after powershell commands
Next, we need to edit the server to default the use of the 256-bit ciphers
1. Click Start->gpedit.msc
2. Expand Computer Configuration -> Administrative Templates -> Network and select SSL Configuration Settings
3. Double click SSL Cipher Suite Order and check Enabled
4. Copy the text from the SSL Cipher Suites and paste it into notepad.
5. Move the following to the beginning of the text document: TLS_RSA_WITH_AES_256_CBC_SHA256,TLS_RSA_WITH_AES_256_CBC_SHA (Note: here you could remove lower strength ciphers from the order to prevent the server from accepting those connections).
6. Paste the Cipher Suites back into the SSL Cipher Suites box in Group Policy and click OK
7. Restart the server for the changes to take effect