tls-auditor

A single-file PowerShell tool that audits a Windows machine's Schannel TLS/SSL protocol configuration and reports which protocols are enabled, optional, disabled, or not supported, together with a compliance verdict. It is designed for quick, repeatable TLS compliance checks across servers, including air-gapped ones.

Why

The effective set of TLS/SSL protocols a Windows machine will negotiate is governed by SCHANNEL registry policy layered on top of per-OS defaults. Reading those keys by hand is error-prone, and an absent key does not mean "off" - it means "use the OS default", which varies by Windows version. tls-auditor reads the policy, resolves the documented OS default for the detected build, and reports the effective state plus a compliance verdict.

Requirements

• Windows with Windows PowerShell 5.1 or PowerShell 7+.
• Local audit needs no special privileges beyond reading HKLM.
• Remote audit needs the Remote Registry service running on the target and appropriate permissions.
• Update mode (refreshing OS-default data) needs Internet access from the machine that runs it.

Quick start

# Audit the local machine (compact table + a per-machine compliance rollup)
.\Test-TlsCompliance.ps1

# Full detail for every protocol/role
.\Test-TlsCompliance.ps1 | Format-List *

# Save an audit record
.\Test-TlsCompliance.ps1 | Export-Csv -NoTypeInformation -Path C:\temp\tls-audit.csv

# Audit remote machines
.\Test-TlsCompliance.ps1 -ComputerName SERVER01,SERVER02 | Format-Table

Offline / air-gapped use

The OS-default table ships as a portable tls-defaults.json. On servers without Internet access, refresh it on a connected machine and copy it across:

# 1. On an Internet-connected machine:
.\Test-TlsCompliance.ps1 -UpdateDefaults -DefaultsPath .\tls-defaults.json

# 2. Copy Test-TlsCompliance.ps1 AND tls-defaults.json to each target server (same folder).

# 3. On each server - it auto-loads tls-defaults.json from beside the script:
.\Test-TlsCompliance.ps1

If no tls-defaults.json is present, the script falls back to a built-in snapshot of the same data.

Remediation

Set-TlsCompliance.ps1 is the companion remediator. It writes the SCHANNEL protocol values (and optionally the .NET strong-crypto values) needed to satisfy the auditor's baseline. It is report-only by default - without -Apply it prints the exact changes it would make and writes nothing - and it also supports the standard -WhatIf/-Confirm switches.

# See what full hardening would change on the local machine (writes nothing)
.\Set-TlsCompliance.ps1

# Disable weak protocols and enable strong ones, backing up the keys first
.\Set-TlsCompliance.ps1 -DisableWeakProtocols -EnableStrongProtocols -Apply -BackupPath C:\tls-backups

# Server-role-only weak-protocol lockdown
.\Set-TlsCompliance.ps1 -ServerOnly -DisableWeakProtocols -Apply

Action switches (-DisableWeakProtocols, -EnableStrongProtocols, -EnableDotNetStrongCrypto) are additive; when none is given, full hardening is planned. -ClientOnly/-ServerOnly scope protocol changes to one role. Registry writes and -BackupPath backups use the .NET registry API rather than reg.exe, so they work where registry-editing tools are blocked by policy and for remote machines. Protocol changes require a reboot to take effect.

See FEATURE-GUIDE.md for full remediator options.

Output

Each protocol/role produces an object with, among others: Protocol, Role, State (configured registry state), OSDefault (documented default for the detected OS), Effective (what actually applies), and Compliance. A per-machine header, a compliance rollup, and a .NET Framework strong-crypto summary are written to the host stream so they do not pollute the object pipeline.

See FEATURE-GUIDE.md for a full description of options and output, and ARCHITECTURE.md for how it works.

Compliance baseline

By default, weak protocols (SSL 2.0, SSL 3.0, TLS 1.0, TLS 1.1) are expected to be disabled/unsupported, and strong protocols (TLS 1.2, TLS 1.3) are expected to be available. The baseline is documented in the script's comment-based help and can be adjusted to your policy.

Contributing

See CONTRIBUTING.md. Agents working in this repository should read AGENT-README.md first.

License

MIT. Third-party notices: THIRD-PARTY-NOTICES.md.