Crosse/SchannelGroupPolicy

[BUG] When enabling TLS 1.2 and TLS 1.3 in the GPO the TLS 1.2 or TLS 1.3 (and weak protocols) settings disappears from the GP result

Opened this issue · 6 comments

Blcktape commented

When enabling TLS 1.3 in the GPO the TLS 1.2 settings disappear from the gpresult page in the Group Policy Management sometimes.
It looks like the settings are not being rendered.
After editing the GPO settings a few times the TLS 1.2 settings appear again. But after refreshing the settings page of the GPO the settings disappear again...

image

image

image

And after refreshing a few times the setting appear again...

image

Seems like a weird bug...

Crosse commented
JavierRodger commented

I can confirm the bug. I just disabled SSL3.0, SSL2.0, PCT and Multi-Protocol. After a while I checked some GPOs and saw nothing in. To fix it, I opened the GPO, enabled Multi-Protocol and disabled it again. In that moment all disabled protcols showed up in the result page.

Any idea to make this more reliable?

Thanks
Javier

JavierRodger commented

It looks like it also not appear in the gpresults, but the confifguration applied successfully

Crosse commented

I have a Windows machine again I can use for testing, so unless someone else using this policy has already solved the problem and can PR their changes, I'll try to figure out what's going on here soon.

JavierRodger commented

Any update on this?

Crosse commented

I was apparently way too optimistic when I said I could test this, because it looks like it's maybe only an issue in the GPMC GUI? While I have a Windows desktop now, I don't have a domain set up, so I can't use GPMC. The behavior I saw when attempting to reproduce this bug by editing local policy via gpedit.msc was that all the settings I changed showed up immediately with gpresult /scope computer /r /v.

Unfortunately, someone other than me will need to dig into this. I've been out of the Windows administration game for five years, now. 😞