Microsoft IIS
TMA-IIS-7.9
Ensure RC4 Cipher Suites is Disabled
Description
The RC4 Cipher Suites are considered insecure, therefore should be disabled. Note: RC4 cipher enabled by default on Server 2012 and 2012 R2 is RC4 128/128. SCHANNEL\Ciphers\RC4 40/128, RC4 56/128, RC4 64/128, RC4 128/128 must exist with Enabled=0 (read via the .NET registry API because the key names contain "/"). PowerShell 5.1; reads the registry (run elevated).
How it is checked
Audit method: Windows registry
$c = 'SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers'; function Get-Cipher($n) { $k = [Microsoft.Win32.Registry]::LocalMachine.OpenSubKey("$c\$n"); $v = $null; if ($k) { $v = $k.GetValue('Enabled'); $k.Close() }; $v }; $bad = @('RC4 40/128', 'RC4 56/128', 'RC4 64/128', 'RC4 128/128' | Where-Object { $v = Get-Cipher $_; $null -eq $v -or [long]$v -ne 0 }); if ($bad.Count -eq 0) { 'compliant' } else { 'noncompliant' }- Expected output
compliant
How it is fixed
Fix method: Guidance or infrastructure patch
([Microsoft.Win32.Registry]::LocalMachine.CreateSubKey('SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 40/128')).SetValue('Enabled', 0, 'DWord') for each listed cipher (PowerShell drive paths cannot contain '/'), then reboot.
Properties
- Operating systems
- Any
- Tags
- iistls
- Reference
- CIS Microsoft IIS 10 Benchmark v1.2.1 - 7.9 Ensure RC4 Cipher Suites is Disabled
Check this host
Run this on a machine you are allowed to audit. The scan is read-only.
tmaegis scan --target iis