Problems with CC4UPD212

[Gorbyhail]

We've installed the CC4UPD212 patch but wish to reverse it for a certain group of machines, essentially re-enabling TLS 1.0 + 1.1. Creating a separate registry policy in which the changes are reversed seems to do nothing (perhaps the patch overrides it at a higher level??) and while removing the registry files the patch adds on individual machines works as a short-term fix, after a couple reboots this reverts.

 

Would anyone here have any insight into how we can solve this without disabling or removing the patch entirely?

[BOOT]

Using [Group Policy Management] find the [RM TLS 1.2] Group Policy.Using the [Delegation]->[Advanced] button.Add the Computer you want to disable and set [Read] to [Deny].You'll still need to fix using the registry, but it won't apply the policy in future.

[Gorbyhail]

Ah! I thought that might work, but decided to wait until I got a response or two on here. Thank you very much, I'll see if I can put that in place on Monday

[AlanD]

What's the problem disabling early TLS? As I understand its a risk... And has been for some time....

[David44]

Unfortunately, some sites still use older versions of TLS.

 

Can anyone who has disabled TLS1.0 and TLS1.1 access this site for example?

https://lloydslink.online.lloydsbank.com/Logon/Logon.jsp

 

Yes,a bank!

[MK-Jester]

Sorry a late contribution, but I would like to continue this discussion.

 

Rather than re-establishing TLS 1.0 surely we should be pressuring sites to fix the problem.

 

Like David44 we use LLoydslink and I am amazed that as a bank they have not updated the site. And if you check the technical requirements for lloydslink they are keen to point out that Windows XP is supported!

 

We are encountering problems with http://www.tponline.co.uk which is the site used by the school to perform a List99 check.

 

Sometimes I despair