enabling tls 1, 1.1, 1.2 via gpo registry, what happens on win2k3?

[oROEchimaru]

If I enable registry keys (schannel) via gpo, they would populate to all servers. what happens on boxes that "cant" support tls 1.1 and 1.2 like win2k3 where the features do not exist? Has anyone done this, does it ignore 1.1 or try to use it and fail? I may need to target win2k3 and win2k8 separately.

https://social.technet.microsoft.co...n-adding-win2k8r2-only-keys?forum=winserverGP

 

[Deleted member 109755]

depends on if you're requiring strict or best effort...

if strict then it will fail
if best effort then it will fall back to unencrypted

 

[oROEchimaru]

well it shouldnt fall back to unencrypted, it should fall back to the option it supports i'm hoping. I'm going to see if I can target OS instead.