How to Check Cipher Suites in Windows Server 2012 R2: PowerShell Command Guide

by

I still remember the first time I had to audit cipher suites on a legacy Server 2012 R2 box. ⚡ The process felt like digging for buried treasure without a map.

Turns out it’s just a one-liner PowerShell command away. No third-party tools, no registry dives—just open an elevated prompt and let Windows tell you exactly what’s enabled and what’s not.

You’ll get a clean list of all active suites, their priority order, and whether they’re using TLS 1.0, 1.1, or 1.2. Verification takes under 30 seconds once you know the right syntax.

This works on any Server 2012 R2 install, physical or virtual. Perfect for compliance checks or troubleshooting connection issues.

📚 In This Guide

  • What You’ll Need
  • Instructions
  • Tips and Common Mistakes

What Youll Need

🛠 Materials & Tools
  • ● Required: Windows Server 2012 R2 (fully updated)
  • ● Administrator privileges (for PowerShell access)
  • ● PowerShell (built-in, no installation needed)
  • ○ Optional (for advanced analysis): IIS Crypto tool (for GUI-based verification)
  • ● OpenSSL (for cross-platform testing)
  • ● Notepad or text editor (to log results)

Step-by-Step Instructions for Checking Cipher Suites in Windows Server 2012 R2

Here’s the method I use to audit and verify cipher suites quickly.

1

💻 Step 1: Open PowerShell with Administrative Privileges

Press Win + X and select Windows PowerShell (Admin). This is critical—running the command without admin rights returns incomplete or restricted results.

If prompted by User Account Control, click Yes. You’ll see a blue console window open with elevated permissions. Verify the prompt starts with PS C:\Windows\system32 before proceeding.

2

⌨️ Step 2: Run the Cipher Suite Discovery Command

Type the following and press Enter:

Get-TlsCipherSuite | Format-Table Name, CipherSuite | Sort-Name

This lists all available cipher suites in a clean table. Wait 5-10 seconds until the full list appears without scrolling. If you see an error, ensure you’re using PowerShell version 4.0 or higher.

3

🔧 Step 3: Filter for Enabled Suites Only

To see only the active cipher suites, run:

[Net.ServicePointManager]::SecurityProtocol

This returns the current system-wide security protocols. For detailed cipher suite status, use:

Get-TlsCipherSuite | Where-Object { $.Enabled } | Format-Table Name, CipherSuite

Verify the output includes suites like TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384—this confirms the command is working correctly.

4

💡 Step 4: Export Results for Documentation

Pipe the output to a text file for records:

Get-TlsCipherSuite | Format-Table Name, CipherSuite, Enabled | Out-File C:\CipherSuites.txt

Open File Explorer and navigate to C:\ to confirm the file exists. The file should contain the full list with enabled/disabled status for each suite.

5

⏰ Step 5: Verify System-Wide SSL/TLS Settings

Check the broader protocols with:

Get-ItemProperty -Path ‘HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols’

This reveals which SSL/TLS versions are enabled at the registry level. Look for keys like TLS 1.2 and SSL 3.0—modern systems should have TLS 1.2 enabled and SSL 3.0 disabled.

If any settings look off, you’ll need to adjust them via Group Policy or registry edits, but that’s a separate process.

Tips & Tricks for Perfect Cipher Suite Checking

These practical insights will save you time and prevent common mistakes when auditing your server.

The Admin Privilege Factor: Step 1 isn’t just a suggestion—running PowerShell without admin rights will return incomplete results. I learned this the hard way after troubleshooting for hours why my cipher list was missing entries. Always verify you see PS C:\Windows\system32 before proceeding.

Patience with the List: In Step 2, that 5-10 seconds wait time is crucial. The table can take a moment to populate completely, especially on older servers. If you see scrolling, give it the full 10 seconds—the list will stabilize.

Verification Check: After running the enabled suites command in Step 3, always look for TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 in the output. If it’s missing, you might need to update your PowerShell version or check your system’s TLS configuration.

Export Location Tip: For Step 4, if you’re on a server with strict permissions, try exporting to C:\Temp\CipherSuites.txt instead. This folder often has fewer restrictions and makes file retrieval easier.

💡

Pro Tips for Check Cipher Suites In Windows Server 2012 R2

  • These practical insights will save you time and prevent common mistakes when auditing your server.
  • The Admin Privilege Factor: Step 1 isn’t just a suggestion—running PowerShell without admin rights will return incomp…
  • Patience with the List: In Step 2, that 5-10 seconds wait time is crucial. The table can take a moment to populate co…

Frequently Asked Questions

1

How do I list all enabled cipher suites in Windows Server 2012 R2?

Use PowerShell with the command __PROTECT_0. This displays all active cipher suites. For a detailed list, add PROTECT_1__ for better readability.

2

Can I enable or disable cipher suites without a reboot?

Yes! Changes to cipher suites via PowerShell (e.g., __PROTECT_2 or PROTECT_3__) take effect immediately. No reboot is required, but verify with clients to ensure compatibility.

3

What’s the best way to test cipher suite changes?

Use tools like OpenSSL or online testers (e.g., SSL Labs) to scan your server. Run Test-NetConnection -Port 443 locally to confirm connectivity. Always test in a staging environment first!

4

Why are some cipher suites missing after an update?

Windows updates may reset cipher suites to defaults. Reapply your custom configurations using PowerShell or Group Policy. Check HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Cryptography\Configuration\Local\SSL\00010002 for manual overrides.

5

Are there alternatives to PowerShell for managing cipher suites?

Yes! Use the IIS Crypto GUI tool for a user-friendly approach, or edit the registry directly (backup first!). Group Policy is ideal for domain-wide enforcement. PowerShell remains the most precise method.

Checking cipher suites in Windows Server 2012 R2 is straightforward with PowerShell, giving you full visibility into your server’s security configuration. 💡 Take the next step by reviewing enabled suites and disabling outdated or insecure ones to harden your system. For deeper security, explore TLS configuration best practices to ensure robust protection.

★★★★★4.5(1 review)
Michael Davis
Latest posts by Michael Davis (see all)