How to Disable 3DES and Blowfish and Enable AES via Group Policy (GPO)

by

This step-by-step guide will show you how to configure your Windows Server to disable 3DES and Blowfish ciphers while enabling and prioritizing AES, all through Group Policy (GPO). By implementing this configuration, you can enhance the security of your servers and meet modern cryptographic standards.

Step 1: Open Group Policy Management

  1. Launch the Group Policy Management Console (GPMC):
    • Press Win + R, type gpmc.msc, and press Enter.
  2. Locate or Create a GPO:
    • Navigate to the Organizational Unit (OU) where your servers reside.
    • Right-click the desired OU and select Create a GPO in this domain, and Link it here.
    • Name the GPO, e.g., Disable 3DES Enable AES.

Step 2: Configure SSL Cipher Suites

Edit the GPO:

  1. Right-click the GPO you created and select Edit.
  2. Navigate to:Computer Configuration > Administrative Templates > Network > SSL Configuration Settings

Modify the Cipher Suite Order:

  1. Double-click on SSL Cipher Suite Order.
  2. Set the policy to Enabled.
  3. Replace the existing cipher suite list with the following recommended list, which prioritizes AES and excludes 3DES:TLS_AES_256_GCM_SHA384,TLS_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_DHE_RSA_WITH_AES_256_GCM_SHA384,TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
  1. Click OK to save changes.

Step 3: Disable Weak Ciphers via Registry (Using GPO Preferences)

To disable 3DES (and Blowfish, if present), you’ll use Group Policy Preferences to push registry changes.

Navigate to Registry Settings:

  1. In the GPO editor, go to:Computer Configuration > Preferences > Windows Settings > Registry

Add Registry Keys to Disable 3DES:

  1. Right-click on Registry and select New > Registry Item.
  2. Configure the registry item:
    • Action: Update
    • Hive: HKEY_LOCAL_MACHINE
    • Key Path: SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\Triple DES 168
    • Value Name: Enabled
    • Value Type: REG_DWORD
    • Value Data: 0

Add Registry Keys for AES:

Repeat the above steps to enable AES ciphers:

  • AES 128/128:
    • Key Path: SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\AES 128/128
    • Value Name: Enabled
    • Value Data: 1
  • AES 256/256:
    • Key Path: SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\AES 256/256
    • Value Name: Enabled
    • Value Data: 1

Disable Blowfish (If Present):

  1. Add a registry key for Blowfish (if it exists):
    • Key Path: SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\Blowfish
    • Value Name: Enabled
    • Value Data: 0

Step 4: Apply and Link the GPO

  1. Close the Group Policy Editor:
    • Once all settings are configured, close the editor.
  2. Link the GPO:
    • In the Group Policy Management Console, right-click the appropriate OU.
    • Select Link an Existing GPO.
    • Choose the GPO you created and click OK.

Step 5: Force Policy Update

To apply the GPO immediately:

  1. Open Command Prompt and run:gpupdate /force
  2. Alternatively, wait for the next Group Policy refresh cycle (default is every 90 minutes).

Step 6: Verify Configuration

Check Cipher Suite Order:

  1. Open PowerShell and run the following command:Get-TlsCipherSuite
  2. Confirm that AES-based ciphers are present and prioritized, while 3DES is absent.

Test Using SSL Labs:

  1. Visit SSL Labs Server Test.
  2. Confirm that 3DES is disabled and AES is enabled.

By following these steps, you can disable 3DES and Blowfish while enabling and prioritizing AES ciphers across all target servers using Group Policy. This ensures consistent and secure configurations for your organization.

Let us know if you have any questions or need additional guidance!

Leave a Comment