AdditionalNetworkHardening.admx

<?xml version="1.0" encoding="utf-8"?>
<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema"
  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0"
  xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
  <policyNamespaces>
    <target prefix="AddNetworkHard" namespace="AddNetworkHard.Policies.AddNetworkHard" />
    <using prefix="windows" namespace="Microsoft.Policies.Windows" />
    <using prefix="parent" namespace="AddHard.Policies.AddHard" />
  </policyNamespaces>
  <resources minRequiredRevision="1.0" />
  <categories>
    <!-- Subcategories -->
    <category name="Network" displayName="$(string.Network)">
      <parentCategory ref="parent:Cat_AddHard" />
    </category>
    <!-- Network categories -->
    <category name="Schannel" displayName="$(string.Schannel)">
      <parentCategory ref="Network" />
    </category>
    <category name="SMB" displayName="$(string.SMB)">
      <parentCategory ref="Network" />
    </category>
    <category name="NETFrame" displayName="$(string.Net)">
      <parentCategory ref="Network" />
    </category>
    <category name="WinHTTP" displayName="$(string.WinHTTP)">
      <parentCategory ref="Network" />
    </category>
    <!-- Schannel categories -->
    <category name="Ciphers" displayName="$(string.Ciphers)">
      <parentCategory ref="Schannel" />
    </category>
    <category name="Hashes" displayName="$(string.Hashes)">
      <parentCategory ref="Schannel" />
    </category>
    <category name="KeyEx" displayName="$(string.KeyEx)">
      <parentCategory ref="Schannel" />
    </category>
    <category name="Protocols" displayName="$(string.Protocols)">
      <parentCategory ref="Schannel" />
    </category>
    <!-- Schannel subcategories -->
    <category name="WeakProtocols" displayName="$(string.WeakProtocols)">
      <parentCategory ref="Protocols" />
    </category>
    <category name="WeakCiphers" displayName="$(string.WeakCiphers)">
      <parentCategory ref="Ciphers" />
    </category>
    <category name="WeakHashes" displayName="$(string.WeakHashes)">
      <parentCategory ref="Hashes" />
    </category>
    <category name="WeakKeyEx" displayName="$(string.WeakKeyEx)">
      <parentCategory ref="KeyEx" />
    </category>
  </categories>
  <policies>
    <!-- Hardening policies section -->
    <!-- 


      NETWORK SETTINGS


    -->
    <policy name="TLS_Ciphersuites" class="Machine" displayName="$(string.TLS_Ciphersuites)"
      explainText="$(string.TLS_Ciphersuites_Help)" presentation="$(presentation.TLS_Ciphersuites)"
      key="SOFTWARE\Policies\Microsoft\Cryptography\Configuration\SSL\00010002">
      <parentCategory ref="Schannel" />
      <supportedOn ref="windows:SUPPORTED_Windows_10_0_RS6" />
      <elements>
        <enum id="TLS_Ciphersuites_Selection" valueName="Functions" required="true">
          <item displayName="$(string.TLS_Ciphersuites0)">
            <value>
              <string>
                TLS_AES_256_GCM_SHA384,TLS_AES_128_GCM_SHA256,TLS_CHACHA20_POLY1305_SHA256,TLS_AES_128_CCM_SHA256</string>
            </value>
          </item>
          <item displayName="$(string.TLS_Ciphersuites1)">
            <value>
              <string>
                TLS_AES_256_GCM_SHA384,TLS_AES_128_GCM_SHA256,TLS_CHACHA20_POLY1305_SHA256,TLS_AES_128_CCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_CCM,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,TLS_DHE_RSA_WITH_AES_256_GCM_SHA384,TLS_DHE_RSA_WITH_AES_128_GCM_SHA256,TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256</string>
            </value>
          </item>
          <item displayName="$(string.TLS_Ciphersuites2)">
            <value>
              <string>
                TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_CCM,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,TLS_DHE_RSA_WITH_AES_256_GCM_SHA384,TLS_DHE_RSA_WITH_AES_128_GCM_SHA256,TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256</string>
            </value>
          </item>
          <item displayName="$(string.TLS_Ciphersuites3)">
            <value>
              <string>
                TLS_AES_256_GCM_SHA384,TLS_AES_128_GCM_SHA256,TLS_CHACHA20_POLY1305_SHA256,TLS_AES_128_CCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_CCM,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,TLS_DHE_RSA_WITH_AES_256_GCM_SHA384,TLS_DHE_RSA_WITH_AES_128_GCM_SHA256,TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256</string>
            </value>
          </item>
          <item displayName="$(string.TLS_Ciphersuites4)">
            <value>
              <string>
                TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_CCM,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,TLS_DHE_RSA_WITH_AES_256_GCM_SHA384,TLS_DHE_RSA_WITH_AES_128_GCM_SHA256,TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256</string>
            </value>
          </item>
        </enum>
      </elements>
    </policy>
    <policy name="Pol_MSS_DisableIPSourceRouting" class="Machine"
      displayName="$(string.DisableIPSourceRouting)"
      explainText="$(string.DisableIPSourceRouting_Help)"
      presentation="$(presentation.DisableIPSourceRouting)"
      key="System\CurrentControlSet\Services\Tcpip\Parameters">
      <parentCategory ref="Network" />
      <supportedOn ref="windows:SUPPORTED_WindowsVista" />
      <elements>
        <enum id="DisableIPSourceRouting" valueName="DisableIPSourceRouting" required="true">
          <item displayName="$(string.DisableIPSourceRouting0)">
            <value>
              <decimal value="0" />
            </value>
          </item>
          <item displayName="$(string.DisableIPSourceRouting1)">
            <value>
              <decimal value="1" />
            </value>
          </item>
          <item displayName="$(string.DisableIPSourceRouting2)">
            <value>
              <decimal value="2" />
            </value>
          </item>
        </enum>
      </elements>
    </policy>
    <policy name="Pol_MSS_DisableIPSourceRoutingIPv6" class="Machine"
      displayName="$(string.DisableIPSourceRoutingIPv6)"
      explainText="$(string.DisableIPSourceRoutingIPv6_Help)"
      presentation="$(presentation.DisableIPSourceRoutingIPv6)"
      key="System\CurrentControlSet\Services\Tcpip6\Parameters">
      <parentCategory ref="Network" />
      <supportedOn ref="windows:SUPPORTED_WindowsVista" />
      <elements>
        <enum id="DisableIPSourceRoutingIPv6" valueName="DisableIPSourceRouting" required="true">
          <item displayName="$(string.DisableIPSourceRouting0)">
            <value>
              <decimal value="0" />
            </value>
          </item>
          <item displayName="$(string.DisableIPSourceRouting1)">
            <value>
              <decimal value="1" />
            </value>
          </item>
          <item displayName="$(string.DisableIPSourceRouting2)">
            <value>
              <decimal value="2" />
            </value>
          </item>
        </enum>
      </elements>
    </policy>
    <policy name="Kerberos_Logging" class="Machine" displayName="$(string.KerberosLogging)"
      explainText="$(string.KerberosLogging_Explain)"
      key="SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Parameters" valueName="LogLevel">
      <parentCategory ref="Network" />
      <supportedOn ref="windows:SUPPORTED_Windows7" />
      <enabledValue>
        <decimal value="1" />
      </enabledValue>
      <disabledValue>
        <decimal value="0" />
      </disabledValue>
    </policy>
    <!-- SMB subsection -->
    <policy name="DisableSMB1" class="Machine" displayName="$(string.DisableSMB1)"
      explainText="$(string.DisableSMB1_Explain)"
      key="SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters">
      <parentCategory ref="SMB" />
      <supportedOn ref="windows:SUPPORTED_Windows_10_0" />
      <enabledList defaultKey="SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters">
        <item key="SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" valueName="SMB1">
          <value>
            <decimal value="0" />
          </value>
        </item>
        <item key="SYSTEM\CurrentControlSet\services\mrxsmb10" valueName="Start">
          <value>
            <decimal value="4" />
          </value>
        </item>
      </enabledList>
    </policy>
    <policy name="MinSMB2Dialect" class="Machine" displayName="$(string.MinSMB2Dialect)"
      explainText="$(string.MinSMB2Dialect_Explain)" presentation="$(presentation.MinSMB2Dialect)"
      key="SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters">
      <parentCategory ref="SMB" />
      <supportedOn ref="windows:SUPPORTED_Windows_10_0_RS3" />
      <elements>
        <enum id="MinSMB2Dialect_Enum" valueName="MinSMB2Dialect">
          <item displayName="$(string.MinSMB2Dialect_202)">
            <value>
              <decimal value="514" />
            </value>
          </item>
          <item displayName="$(string.MinSMB2Dialect_210)">
            <value>
              <decimal value="528" />
            </value>
          </item>
          <item displayName="$(string.MinSMB2Dialect_300)">
            <value>
              <decimal value="768" />
            </value>
          </item>
          <item displayName="$(string.MinSMB2Dialect_302)">
            <value>
              <decimal value="770" />
            </value>
          </item>
          <item displayName="$(string.MinSMB2Dialect_311)">
            <value>
              <decimal value="785" />
            </value>
          </item>
          <item displayName="$(string.MinSMB2Dialect_Remove)">
            <value>
              <delete />
            </value>
          </item>
        </enum>
      </elements>
    </policy>
    <policy name="MaxSMB2Dialect" class="Machine" displayName="$(string.MaxSMB2Dialect)"
      explainText="$(string.MaxSMB2Dialect_Explain)" presentation="$(presentation.MaxSMB2Dialect)"
      key="SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters">
      <parentCategory ref="SMB" />
      <supportedOn ref="windows:SUPPORTED_Windows_10_0_RS3" />
      <elements>
        <enum id="MaxSMB2Dialect_Enum" valueName="MaxSMB2Dialect">
          <item displayName="$(string.MaxSMB2Dialect_202)">
            <value>
              <decimal value="514" />
            </value>
          </item>
          <item displayName="$(string.MaxSMB2Dialect_210)">
            <value>
              <decimal value="528" />
            </value>
          </item>
          <item displayName="$(string.MaxSMB2Dialect_300)">
            <value>
              <decimal value="768" />
            </value>
          </item>
          <item displayName="$(string.MaxSMB2Dialect_302)">
            <value>
              <decimal value="770" />
            </value>
          </item>
          <item displayName="$(string.MaxSMB2Dialect_311)">
            <value>
              <decimal value="785" />
            </value>
          </item>
          <item displayName="$(string.MaxSMB2Dialect_Remove)">
            <value>
              <delete />
            </value>
          </item>
        </enum>
      </elements>
    </policy>
    <!-- WinHTTP subsection -->
    <policy name="WinHTTP_TLS12" class="Machine" displayName="$(string.WinHTTP_TLS12)"
      explainText="$(string.WinHTTP_TLS12_Explain)"
      key="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\WinHttp"
      valueName="DefaultSecureProtocols">
      <parentCategory ref="WinHTTP" />
      <supportedOn ref="windows:SUPPORTED_Windows7" />
      <enabledList>
        <item key="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\WinHttp"
          valueName="DefaultSecureProtocols">
          <value>
            <decimal value="2048" />
          </value>
        </item>
        <item key="SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\WinHttp"
          valueName="DefaultSecureProtocols">
          <value>
            <decimal value="2048" />
          </value>
        </item>
      </enabledList>
      <disabledList>
        <item key="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\WinHttp"
          valueName="DefaultSecureProtocols">
          <value>
            <delete />
          </value>
        </item>
        <item key="SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\WinHttp"
          valueName="DefaultSecureProtocols">
          <value>
            <delete />
          </value>
        </item>
      </disabledList>
    </policy>
    <!-- Schannel subsection -->
    <policy name="SchannelLogging" class="Machine" displayName="$(string.SchannelLogging)"
      explainText="$(string.SchannelLogging_Explain)"
      presentation="$(presentation.SchannelLogging_Presentation)"
      key="SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL" valueName="EventLogging">
      <parentCategory ref="Schannel" />
      <supportedOn ref="windows:SUPPORTED_Windows7" />
      <elements>
        <enum id="SchannelLogging_DropdownList" valueName="EventLogging" required="true">
          <item displayName="$(string.SchannelLogging_Option1)">
            <value>
              <decimal value="1" />
            </value>
          </item>
          <item displayName="$(string.SchannelLogging_Option2)">
            <value>
              <decimal value="2" />
            </value>
          </item>
          <item displayName="$(string.SchannelLogging_Option3)">
            <value>
              <decimal value="3" />
            </value>
          </item>
          <item displayName="$(string.SchannelLogging_Option4)">
            <value>
              <decimal value="4" />
            </value>
          </item>
          <item displayName="$(string.SchannelLogging_Option5)">
            <value>
              <decimal value="5" />
            </value>
          </item>
          <item displayName="$(string.SchannelLogging_Option6)">
            <value>
              <decimal value="6" />
            </value>
          </item>
          <item displayName="$(string.SchannelLogging_Option7)">
            <value>
              <decimal value="7" />
            </value>
          </item>
          <item displayName="$(string.SchannelLogging_Option8)">
            <value>
              <decimal value="0" />
            </value>
          </item>
        </enum>
      </elements>
    </policy>
    <!-- PROTOCOLS -->
    <!-- Multi-Protocol Unified Hello should always be disabled, and
             Schannel will apparently never use it. -->
    <policy name="MPUH" class="Machine" displayName="$(string.MPUH)"
      explainText="$(string.MPUH_Help)" presentation="$(presentation.MPUH)"
      key="SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\Multi-Protocol Unified Hello">
      <parentCategory ref="WeakProtocols" />
      <supportedOn ref="windows:SUPPORTED_Win2k" />
      <elements>
        <boolean id="MPUH_ClientCheckbox"
          key="SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\Multi-Protocol Unified Hello\Client"
          valueName="Enabled">
          <trueList
            defaultKey="SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\Multi-Protocol Unified Hello\Client">
            <item valueName="Enabled">
              <value>
                <decimal value="1" />
              </value>
            </item>
            <item valueName="DisabledByDefault">
              <value>
                <decimal value="0" />
              </value>
            </item>
          </trueList>
          <falseList
            defaultKey="SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\Multi-Protocol Unified Hello\Client">
            <item valueName="Enabled">
              <value>
                <decimal value="0" />
              </value>
            </item>
            <item valueName="DisabledByDefault">
              <value>
                <decimal value="1" />
              </value>
            </item>
          </falseList>
        </boolean>
        <boolean id="MPUH_ServerCheckbox"
          key="SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\Multi-Protocol Unified Hello\Server"
          valueName="Enabled">
          <trueList
            defaultKey="SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\Multi-Protocol Unified Hello\Server">
            <item valueName="Enabled">
              <value>
                <decimal value="1" />
              </value>
            </item>
            <item valueName="DisabledByDefault">
              <value>
                <decimal value="0" />
              </value>
            </item>
          </trueList>
          <falseList
            defaultKey="SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\Multi-Protocol Unified Hello\Server">
            <item valueName="Enabled">
              <value>
                <decimal value="0" />
              </value>
            </item>
            <item valueName="DisabledByDefault">
              <value>
                <decimal value="1" />
              </value>
            </item>
          </falseList>
        </boolean>
      </elements>
    </policy>
    <!-- PCT 1.0 should always be disabled, and Schannel will apparently
             never use it. -->
    <policy name="PCTv1" class="Machine" displayName="$(string.PCTv1)"
      explainText="$(string.PCTv1_Help)" presentation="$(presentation.PCTv1)"
      key="SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\PCT 1.0">
      <parentCategory ref="WeakProtocols" />
      <supportedOn ref="windows:SUPPORTED_Win2k" />
      <elements>
        <boolean id="PCTv1_ClientCheckbox"
          key="SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\PCT 1.0\Client"
          valueName="Enabled">
          <trueList
            defaultKey="SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\PCT 1.0\Client">
            <item valueName="Enabled">
              <value>
                <decimal value="1" />
              </value>
            </item>
            <item valueName="DisabledByDefault">
              <value>
                <decimal value="0" />
              </value>
            </item>
          </trueList>
          <falseList
            defaultKey="SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\PCT 1.0\Client">
            <item valueName="Enabled">
              <value>
                <decimal value="0" />
              </value>
            </item>
            <item valueName="DisabledByDefault">
              <value>
                <decimal value="1" />
              </value>
            </item>
          </falseList>
        </boolean>
        <boolean id="PCTv1_ServerCheckbox"
          key="SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\PCT 1.0\Server"
          valueName="Enabled">
          <trueList
            defaultKey="SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\PCT 1.0\Server">
            <item valueName="Enabled">
              <value>
                <decimal value="1" />
              </value>
            </item>
            <item valueName="DisabledByDefault">
              <value>
                <decimal value="0" />
              </value>
            </item>
          </trueList>
          <falseList
            defaultKey="SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\PCT 1.0\Server">
            <item valueName="Enabled">
              <value>
                <decimal value="0" />
              </value>
            </item>
            <item valueName="DisabledByDefault">
              <value>
                <decimal value="1" />
              </value>
            </item>
          </falseList>
        </boolean>
      </elements>
    </policy>
    <!-- SSLv2 should always be disabled. -->
    <policy name="SSLv2" class="Machine" displayName="$(string.SSLv2)"
      explainText="$(string.SSLv2_Help)" presentation="$(presentation.SSLv2)"
      key="SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0">
      <parentCategory ref="WeakProtocols" />
      <supportedOn ref="windows:SUPPORTED_Win2k" />
      <elements>
        <boolean id="SSLv2_ClientCheckbox"
          key="SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Client"
          valueName="Enabled">
          <trueList
            defaultKey="SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Client">
            <item valueName="Enabled">
              <value>
                <decimal value="1" />
              </value>
            </item>
            <item valueName="DisabledByDefault">
              <value>
                <decimal value="0" />
              </value>
            </item>
          </trueList>
          <falseList
            defaultKey="SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Client">
            <item valueName="Enabled">
              <value>
                <decimal value="0" />
              </value>
            </item>
            <item valueName="DisabledByDefault">
              <value>
                <decimal value="1" />
              </value>
            </item>
          </falseList>
        </boolean>
        <boolean id="SSLv2_ServerCheckbox"
          key="SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Server"
          valueName="Enabled">
          <trueList
            defaultKey="SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Server">
            <item valueName="Enabled">
              <value>
                <decimal value="1" />
              </value>
            </item>
            <item valueName="DisabledByDefault">
              <value>
                <decimal value="0" />
              </value>
            </item>
          </trueList>
          <falseList
            defaultKey="SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Server">
            <item valueName="Enabled">
              <value>
                <decimal value="0" />
              </value>
            </item>
            <item valueName="DisabledByDefault">
              <value>
                <decimal value="1" />
              </value>
            </item>
          </falseList>
        </boolean>
      </elements>
    </policy>
    <!-- SSLv3 should be disabled -->
    <policy name="SSLv3" class="Machine" displayName="$(string.SSLv3)"
      explainText="$(string.SSLv3_Help)" presentation="$(presentation.SSLv3)"
      key="SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0">
      <parentCategory ref="WeakProtocols" />
      <supportedOn ref="windows:SUPPORTED_Win2k" />
      <elements>
        <boolean id="SSLv3_ClientCheckbox"
          key="SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Client"
          valueName="Enabled">
          <trueList
            defaultKey="SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Client">
            <item valueName="Enabled">
              <value>
                <decimal value="1" />
              </value>
            </item>
            <item valueName="DisabledByDefault">
              <value>
                <decimal value="0" />
              </value>
            </item>
          </trueList>
          <falseList
            defaultKey="SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Client">
            <item valueName="Enabled">
              <value>
                <decimal value="0" />
              </value>
            </item>
            <item valueName="DisabledByDefault">
              <value>
                <decimal value="1" />
              </value>
            </item>
          </falseList>
        </boolean>
        <boolean id="SSLv3_ServerCheckbox"
          key="SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server"
          valueName="Enabled">
          <trueList
            defaultKey="SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server">
            <item valueName="Enabled">
              <value>
                <decimal value="1" />
              </value>
            </item>
            <item valueName="DisabledByDefault">
              <value>
                <decimal value="0" />
              </value>
            </item>
          </trueList>
          <falseList
            defaultKey="SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server">
            <item valueName="Enabled">
              <value>
                <decimal value="0" />
              </value>
            </item>
            <item valueName="DisabledByDefault">
              <value>
                <decimal value="1" />
              </value>
            </item>
          </falseList>
        </boolean>
      </elements>
    </policy>
    <!-- TLSv1.0 -->
    <policy name="TLSv10" class="Machine" displayName="$(string.TLSv10)"
      explainText="$(string.TLSv10_Help)" presentation="$(presentation.TLSv10)"
      key="SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0">
      <parentCategory ref="WeakProtocols" />
      <supportedOn ref="windows:SUPPORTED_Win2k" />
      <elements>
        <boolean id="TLSv10_ClientCheckbox"
          key="SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Client"
          valueName="Enabled">
          <trueList
            defaultKey="SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Client">
            <item valueName="Enabled">
              <value>
                <decimal value="1" />
              </value>
            </item>
            <item valueName="DisabledByDefault">
              <value>
                <decimal value="0" />
              </value>
            </item>
          </trueList>
          <falseList
            defaultKey="SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Client">
            <item valueName="Enabled">
              <value>
                <decimal value="0" />
              </value>
            </item>
            <item valueName="DisabledByDefault">
              <value>
                <decimal value="1" />
              </value>
            </item>
          </falseList>
        </boolean>
        <boolean id="TLSv10_ServerCheckbox"
          key="SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server"
          valueName="Enabled">
          <trueList
            defaultKey="SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server">
            <item valueName="Enabled">
              <value>
                <decimal value="1" />
              </value>
            </item>
            <item valueName="DisabledByDefault">
              <value>
                <decimal value="0" />
              </value>
            </item>
          </trueList>
          <falseList
            defaultKey="SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server">
            <item valueName="Enabled">
              <value>
                <decimal value="0" />
              </value>
            </item>
            <item valueName="DisabledByDefault">
              <value>
                <decimal value="1" />
              </value>
            </item>
          </falseList>
        </boolean>
      </elements>
    </policy>
    <!-- TLSv1.1 -->
    <policy name="TLSv11" class="Machine" displayName="$(string.TLSv11)"
      explainText="$(string.TLSv11_Help)" presentation="$(presentation.TLSv11)"
      key="SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1">
      <parentCategory ref="WeakProtocols" />
      <supportedOn ref="windows:SUPPORTED_Windows7" />
      <elements>
        <boolean id="TLSv11_ClientCheckbox"
          key="SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Client"
          valueName="Enabled">
          <trueList
            defaultKey="SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Client">
            <item valueName="Enabled">
              <value>
                <decimal value="1" />
              </value>
            </item>
            <item valueName="DisabledByDefault">
              <value>
                <decimal value="0" />
              </value>
            </item>
          </trueList>
          <falseList
            defaultKey="SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Client">
            <item valueName="Enabled">
              <value>
                <decimal value="0" />
              </value>
            </item>
            <item valueName="DisabledByDefault">
              <value>
                <decimal value="1" />
              </value>
            </item>
          </falseList>
        </boolean>
        <boolean id="TLSv11_ServerCheckbox"
          key="SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server"
          valueName="Enabled">
          <trueList
            defaultKey="SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server">
            <item valueName="Enabled">
              <value>
                <decimal value="1" />
              </value>
            </item>
            <item valueName="DisabledByDefault">
              <value>
                <decimal value="0" />
              </value>
            </item>
          </trueList>
          <falseList
            defaultKey="SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server">
            <item valueName="Enabled">
              <value>
                <decimal value="0" />
              </value>
            </item>
            <item valueName="DisabledByDefault">
              <value>
                <decimal value="1" />
              </value>
            </item>
          </falseList>
        </boolean>
      </elements>
    </policy>
    <!-- TLSv1.2 -->
    <policy name="TLSv12" class="Machine" displayName="$(string.TLSv12)"
      explainText="$(string.TLSv12_Help)" presentation="$(presentation.TLSv12)"
      key="SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2">
      <parentCategory ref="Protocols" />
      <supportedOn ref="windows:SUPPORTED_Windows7" />
      <elements>
        <boolean id="TLSv12_ClientCheckbox"
          key="SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client"
          valueName="Enabled">
          <trueList
            defaultKey="SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client">
            <item valueName="Enabled">
              <value>
                <decimal value="1" />
              </value>
            </item>
            <item valueName="DisabledByDefault">
              <value>
                <decimal value="0" />
              </value>
            </item>
          </trueList>
          <falseList
            defaultKey="SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client">
            <item valueName="Enabled">
              <value>
                <decimal value="0" />
              </value>
            </item>
            <item valueName="DisabledByDefault">
              <value>
                <decimal value="1" />
              </value>
            </item>
          </falseList>
        </boolean>
        <boolean id="TLSv12_ServerCheckbox"
          key="SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server"
          valueName="Enabled">
          <trueList
            defaultKey="SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server">
            <item valueName="Enabled">
              <value>
                <decimal value="1" />
              </value>
            </item>
            <item valueName="DisabledByDefault">
              <value>
                <decimal value="0" />
              </value>
            </item>
          </trueList>
          <falseList
            defaultKey="SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server">
            <item valueName="Enabled">
              <value>
                <decimal value="0" />
              </value>
            </item>
            <item valueName="DisabledByDefault">
              <value>
                <decimal value="1" />
              </value>
            </item>
          </falseList>
        </boolean>
      </elements>
    </policy>
    <!-- TLSv1.3 -->
    <policy name="TLSv13" class="Machine" displayName="$(string.TLSv13)"
      explainText="$(string.TLSv13_Help)" presentation="$(presentation.TLSv13)"
      key="SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.3">
      <parentCategory ref="Protocols" />
      <supportedOn ref="windows:SUPPORTED_Windows_10_0_RS6_NOSERVER" />
      <elements>
        <boolean id="TLSv13_ClientCheckbox"
          key="SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.3\Client"
          valueName="Enabled">
          <trueList
            defaultKey="SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.3\Client">
            <item valueName="Enabled">
              <value>
                <decimal value="1" />
              </value>
            </item>
            <item valueName="DisabledByDefault">
              <value>
                <decimal value="0" />
              </value>
            </item>
          </trueList>
          <falseList
            defaultKey="SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.3\Client">
            <item valueName="Enabled">
              <value>
                <decimal value="0" />
              </value>
            </item>
            <item valueName="DisabledByDefault">
              <value>
                <decimal value="1" />
              </value>
            </item>
          </falseList>
        </boolean>
        <boolean id="TLSv13_ServerCheckbox"
          key="SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.3\Server"
          valueName="Enabled">
          <trueList
            defaultKey="SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.3\Server">
            <item valueName="Enabled">
              <value>
                <decimal value="1" />
              </value>
            </item>
            <item valueName="DisabledByDefault">
              <value>
                <decimal value="0" />
              </value>
            </item>
          </trueList>
          <falseList
            defaultKey="SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.3\Server">
            <item valueName="Enabled">
              <value>
                <decimal value="0" />
              </value>
            </item>
            <item valueName="DisabledByDefault">
              <value>
                <decimal value="1" />
              </value>
            </item>
          </falseList>
        </boolean>
      </elements>
    </policy>
    <!-- DTLSv1.0 -->
    <policy name="DTLSv10" class="Machine" displayName="$(string.DTLSv10)"
      explainText="$(string.DTLSv10_Help)" presentation="$(presentation.DTLSv10)"
      key="SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\DTLS 1.0">
      <parentCategory ref="WeakProtocols" />
      <supportedOn ref="windows:SUPPORTED_Windows7" />
      <elements>
        <boolean id="DTLSv10_ClientCheckbox"
          key="SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\DTLS 1.0\Client"
          valueName="Enabled">
          <trueList
            defaultKey="SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\DTLS 1.0\Client">
            <item valueName="Enabled">
              <value>
                <decimal value="1" />
              </value>
            </item>
            <item valueName="DisabledByDefault">
              <value>
                <decimal value="0" />
              </value>
            </item>
          </trueList>
          <falseList
            defaultKey="SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\DTLS 1.0\Client">
            <item valueName="Enabled">
              <value>
                <decimal value="0" />
              </value>
            </item>
            <item valueName="DisabledByDefault">
              <value>
                <decimal value="1" />
              </value>
            </item>
          </falseList>
        </boolean>
        <boolean id="DTLSv10_ServerCheckbox"
          key="SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\DTLS 1.0\Server"
          valueName="Enabled">
          <trueList
            defaultKey="SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\DTLS 1.0\Server">
            <item valueName="Enabled">
              <value>
                <decimal value="1" />
              </value>
            </item>
            <item valueName="DisabledByDefault">
              <value>
                <decimal value="0" />
              </value>
            </item>
          </trueList>
          <falseList
            defaultKey="SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\DTLS 1.0\Server">
            <item valueName="Enabled">
              <value>
                <decimal value="0" />
              </value>
            </item>
            <item valueName="DisabledByDefault">
              <value>
                <decimal value="1" />
              </value>
            </item>
          </falseList>
        </boolean>
      </elements>
    </policy>
    <!-- DTLSv1.2 -->
    <policy name="DTLSv12" class="Machine" displayName="$(string.DTLSv12)"
      explainText="$(string.DTLSv12_Help)" presentation="$(presentation.DTLSv12)"
      key="SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\DTLS 1.2">
      <parentCategory ref="Protocols" />
      <supportedOn ref="windows:SUPPORTED_Windows7" />
      <elements>
        <boolean id="DTLSv12_ClientCheckbox"
          key="SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\DTLS 1.2\Client"
          valueName="Enabled">
          <trueList
            defaultKey="SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\DTLS 1.2\Client">
            <item valueName="Enabled">
              <value>
                <decimal value="1" />
              </value>
            </item>
            <item valueName="DisabledByDefault">
              <value>
                <decimal value="0" />
              </value>
            </item>
          </trueList>
          <falseList
            defaultKey="SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\DTLS 1.2\Client">
            <item valueName="Enabled">
              <value>
                <decimal value="0" />
              </value>
            </item>
            <item valueName="DisabledByDefault">
              <value>
                <decimal value="1" />
              </value>
            </item>
          </falseList>
        </boolean>
        <boolean id="DTLSv12_ServerCheckbox"
          key="SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\DTLS 1.2\Server"
          valueName="Enabled">
          <trueList
            defaultKey="SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\DTLS 1.2\Server">
            <item valueName="Enabled">
              <value>
                <decimal value="1" />
              </value>
            </item>
            <item valueName="DisabledByDefault">
              <value>
                <decimal value="0" />
              </value>
            </item>
          </trueList>
          <falseList
            defaultKey="SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\DTLS 1.2\Server">
            <item valueName="Enabled">
              <value>
                <decimal value="0" />
              </value>
            </item>
            <item valueName="DisabledByDefault">
              <value>
                <decimal value="1" />
              </value>
            </item>
          </falseList>
        </boolean>
      </elements>
    </policy>
    <!-- DTLSv1.3 -->
    <policy name="DTLSv13" class="Machine" displayName="$(string.DTLSv13)"
      explainText="$(string.DTLSv13_Help)" presentation="$(presentation.DTLSv13)"
      key="SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\DTLS 1.3">
      <parentCategory ref="Protocols" />
      <supportedOn ref="windows:SUPPORTED_Windows_10_0_RS6_NOSERVER" />
      <elements>
        <boolean id="DTLSv13_ClientCheckbox"
          key="SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\DTLS 1.3\Client"
          valueName="Enabled">
          <trueList
            defaultKey="SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\DTLS 1.3\Client">
            <item valueName="Enabled">
              <value>
                <decimal value="1" />
              </value>
            </item>
            <item valueName="DisabledByDefault">
              <value>
                <decimal value="0" />
              </value>
            </item>
          </trueList>
          <falseList
            defaultKey="SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\DTLS 1.3\Client">
            <item valueName="Enabled">
              <value>
                <decimal value="0" />
              </value>
            </item>
            <item valueName="DisabledByDefault">
              <value>
                <decimal value="1" />
              </value>
            </item>
          </falseList>
        </boolean>
        <boolean id="DTLSv13_ServerCheckbox"
          key="SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\DTLS 1.3\Server"
          valueName="Enabled">
          <trueList
            defaultKey="SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\DTLS 1.3\Server">
            <item valueName="Enabled">
              <value>
                <decimal value="1" />
              </value>
            </item>
            <item valueName="DisabledByDefault">
              <value>
                <decimal value="0" />
              </value>
            </item>
          </trueList>
          <falseList
            defaultKey="SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\DTLS 1.3\Server">
            <item valueName="Enabled">
              <value>
                <decimal value="0" />
              </value>
            </item>
            <item valueName="DisabledByDefault">
              <value>
                <decimal value="1" />
              </value>
            </item>
          </falseList>
        </boolean>
      </elements>
    </policy>
    <!-- END PROTOCOLS -->
    <!-- ENCRYPTION CIPHERS -->
    <!-- NULL -->
    <policy name="NULL" class="Machine" displayName="$(string.NULL)"
      explainText="$(string.NULL_Help)" valueName="Enabled"
      key="SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\NULL">
      <parentCategory ref="WeakCiphers" />
      <supportedOn ref="windows:SUPPORTED_WindowsUpdate" />
      <enabledValue>
        <decimal value="4294967295" />
      </enabledValue>
      <disabledValue>
        <decimal value="0" />
      </disabledValue>
    </policy>
    <!-- DES 56/56 -->
    <policy name="DES_56" class="Machine" displayName="$(string.DES_56)"
      explainText="$(string.DES_56_Help)" valueName="Enabled"
      key="SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\DES 56/56">
      <parentCategory ref="WeakCiphers" />
      <supportedOn ref="windows:SUPPORTED_WindowsUpdate" />
      <enabledValue>
        <decimal value="4294967295" />
      </enabledValue>
      <disabledValue>
        <decimal value="0" />
      </disabledValue>
    </policy>
    <!-- RC2 40/128 -->
    <policy name="RC2_40" class="Machine" displayName="$(string.RC2_40)"
      explainText="$(string.RC2_40_Help)" valueName="Enabled"
      key="SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC2 40/128">
      <parentCategory ref="WeakCiphers" />
      <supportedOn ref="windows:SUPPORTED_WindowsUpdate" />
      <enabledValue>
        <decimal value="4294967295" />
      </enabledValue>
      <disabledValue>
        <decimal value="0" />
      </disabledValue>
    </policy>
    <!-- RC2 56/128 -->
    <policy name="RC2_56" class="Machine" displayName="$(string.RC2_56)"
      explainText="$(string.RC2_56_Help)" valueName="Enabled"
      key="SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC2 56/128">
      <parentCategory ref="WeakCiphers" />
      <supportedOn ref="windows:SUPPORTED_WindowsUpdate" />
      <enabledValue>
        <decimal value="4294967295" />
      </enabledValue>
      <disabledValue>
        <decimal value="0" />
      </disabledValue>
    </policy>
    <!-- RC2 128/128 -->
    <policy name="RC2_128" class="Machine" displayName="$(string.RC2_128)"
      explainText="$(string.RC2_128_Help)" valueName="Enabled"
      key="SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC2 128/128">
      <parentCategory ref="WeakCiphers" />
      <supportedOn ref="windows:SUPPORTED_WindowsUpdate" />
      <enabledValue>
        <decimal value="4294967295" />
      </enabledValue>
      <disabledValue>
        <decimal value="0" />
      </disabledValue>
    </policy>
    <!-- RC4 40/128 -->
    <policy name="RC4_40" class="Machine" displayName="$(string.RC4_40)"
      explainText="$(string.RC4_40_Help)" valueName="Enabled"
      key="SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 40/128">
      <parentCategory ref="WeakCiphers" />
      <supportedOn ref="windows:SUPPORTED_WindowsUpdate" />
      <enabledValue>
        <decimal value="4294967295" />
      </enabledValue>
      <disabledValue>
        <decimal value="0" />
      </disabledValue>
    </policy>
    <!-- RC4 56/128 -->
    <policy name="RC4_56" class="Machine" displayName="$(string.RC4_56)"
      explainText="$(string.RC4_56_Help)" valueName="Enabled"
      key="SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 56/128">
      <parentCategory ref="WeakCiphers" />
      <supportedOn ref="windows:SUPPORTED_WindowsUpdate" />
      <enabledValue>
        <decimal value="4294967295" />
      </enabledValue>
      <disabledValue>
        <decimal value="0" />
      </disabledValue>
    </policy>
    <!-- RC4 64/128 -->
    <policy name="RC4_64" class="Machine" displayName="$(string.RC4_64)"
      explainText="$(string.RC4_64_Help)" valueName="Enabled"
      key="SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 64/128">
      <parentCategory ref="WeakCiphers" />
      <supportedOn ref="windows:SUPPORTED_WindowsUpdate" />
      <enabledValue>
        <decimal value="4294967295" />
      </enabledValue>
      <disabledValue>
        <decimal value="0" />
      </disabledValue>
    </policy>
    <!-- RC4 128/128 -->
    <policy name="RC4_128" class="Machine" displayName="$(string.RC4_128)"
      explainText="$(string.RC4_128_Help)" valueName="Enabled"
      key="SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 128/128">
      <parentCategory ref="WeakCiphers" />
      <supportedOn ref="windows:SUPPORTED_WindowsUpdate" />
      <enabledValue>
        <decimal value="4294967295" />
      </enabledValue>
      <disabledValue>
        <decimal value="0" />
      </disabledValue>
    </policy>
    <!-- Triple-DES 168 -->
    <policy name="3DES" class="Machine" displayName="$(string.3DES)"
      explainText="$(string.3DES_Help)" valueName="Enabled"
      key="SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\Triple DES 168">
      <parentCategory ref="WeakCiphers" />
      <supportedOn ref="windows:SUPPORTED_WindowsUpdate" />
      <enabledValue>
        <decimal value="4294967295" />
      </enabledValue>
      <disabledValue>
        <decimal value="0" />
      </disabledValue>
    </policy>
    <!-- AES 128/128 -->
    <policy name="AES128" class="Machine" displayName="$(string.AES128)"
      explainText="$(string.AES128_Help)" valueName="Enabled"
      key="SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\AES 128/128">
      <parentCategory ref="Ciphers" />
      <supportedOn ref="windows:SUPPORTED_WindowsNET" />
      <enabledValue>
        <decimal value="4294967295" />
      </enabledValue>
      <disabledValue>
        <decimal value="0" />
      </disabledValue>
    </policy>
    <!-- AES 256/256 -->
    <policy name="AES256" class="Machine" displayName="$(string.AES256)"
      explainText="$(string.AES256_Help)" valueName="Enabled"
      key="SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\AES 256/256">
      <parentCategory ref="Ciphers" />
      <supportedOn ref="windows:SUPPORTED_WindowsNET" />
      <enabledValue>
        <decimal value="4294967295" />
      </enabledValue>
      <disabledValue>
        <decimal value="0" />
      </disabledValue>
    </policy>
    <!-- END ENCRYPTION CIPHERS -->
    <!-- HASHING ALGORITHMS -->
    <!-- MD5 -->
    <policy name="MD5" class="Machine" displayName="$(string.MD5)" explainText="$(string.MD5_Help)"
      valueName="Enabled"
      key="SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Hashes\MD5">
      <parentCategory ref="WeakHashes" />
      <supportedOn ref="windows:SUPPORTED_WindowsNET" />
      <enabledValue>
        <decimal value="4294967295" />
      </enabledValue>
      <disabledValue>
        <decimal value="0" />
      </disabledValue>
    </policy>
    <!-- SHA-1 -->
    <policy name="SHA" class="Machine" displayName="$(string.SHA)" explainText="$(string.SHA_Help)"
      valueName="Enabled"
      key="SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Hashes\SHA">
      <parentCategory ref="WeakHashes" />
      <supportedOn ref="windows:SUPPORTED_WindowsNET" />
      <enabledValue>
        <decimal value="4294967295" />
      </enabledValue>
      <disabledValue>
        <decimal value="0" />
      </disabledValue>
    </policy>
    <!-- SHA-256 -->
    <policy name="SHA256" class="Machine" displayName="$(string.SHA256)"
      explainText="$(string.SHA256_Help)" valueName="Enabled"
      key="SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Hashes\SHA256">
      <parentCategory ref="Hashes" />
      <supportedOn ref="windows:SUPPORTED_Windows7" />
      <enabledValue>
        <decimal value="4294967295" />
      </enabledValue>
      <disabledValue>
        <decimal value="0" />
      </disabledValue>
    </policy>
    <!-- SHA-384 -->
    <policy name="SHA384" class="Machine" displayName="$(string.SHA384)"
      explainText="$(string.SHA384_Help)" valueName="Enabled"
      key="SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Hashes\SHA384">
      <parentCategory ref="Hashes" />
      <supportedOn ref="windows:SUPPORTED_Windows7" />
      <enabledValue>
        <decimal value="4294967295" />
      </enabledValue>
      <disabledValue>
        <decimal value="0" />
      </disabledValue>
    </policy>
    <!-- SHA-512 -->
    <policy name="SHA512" class="Machine" displayName="$(string.SHA512)"
      explainText="$(string.SHA512_Help)" valueName="Enabled"
      key="SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Hashes\SHA512">
      <parentCategory ref="Hashes" />
      <supportedOn ref="windows:SUPPORTED_Windows7" />
      <enabledValue>
        <decimal value="4294967295" />
      </enabledValue>
      <disabledValue>
        <decimal value="0" />
      </disabledValue>
    </policy>
    <!-- END HASHING ALGORITHMS -->
    <!-- KEY EXCHANGE ALGORITHMS -->
    <!-- Diffie-Hellman -->
    <policy name="DH" class="Machine" displayName="$(string.DH)" explainText="$(string.DH_Help)"
      valueName="Enabled"
      key="SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\KeyExchangeAlgorithms\Diffie-Hellman">
      <parentCategory ref="KeyEx" />
      <supportedOn ref="windows:SUPPORTED_WindowsUpdate" />
      <enabledValue>
        <decimal value="4294967295" />
      </enabledValue>
      <disabledValue>
        <decimal value="0" />
      </disabledValue>
    </policy>
    <policy name="DHServer" class="Machine" displayName="$(string.DHServer)"
      explainText="$(string.DHServer_Help)" presentation="$(presentation.DHServer)"
      key="SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\KeyExchangeAlgorithms\Diffie-Hellman">
      <parentCategory ref="KeyEx" />
      <supportedOn ref="SUPPORTED_3174644" />
      <elements>
        <enum id="DHServer_MinLength" valueName="ServerMinKeyBitLength">
          <item displayName="$(string.DH_Value2048)">
            <value>
              <decimal value="2048" />
            </value>
          </item>
          <item displayName="$(string.DH_Value3072)">
            <value>
              <decimal value="3072" />
            </value>
          </item>
          <item displayName="$(string.DH_Value4096)">
            <value>
              <decimal value="4096" />
            </value>
          </item>
        </enum>
      </elements>
    </policy>
    <policy name="DHClient" class="Machine" displayName="$(string.DHClient)"
      explainText="$(string.DHClient_Help)" presentation="$(presentation.DHClient)"
      key="SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\KeyExchangeAlgorithms\Diffie-Hellman">
      <parentCategory ref="KeyEx" />
      <supportedOn ref="SUPPORTED_3174644" />
      <elements>
        <enum id="DHClient_MinLength" valueName="ClientMinKeyBitLength">
          <item displayName="$(string.DH_Value2048)">
            <value>
              <decimal value="2048" />
            </value>
          </item>
          <item displayName="$(string.DH_Value3072)">
            <value>
              <decimal value="3072" />
            </value>
          </item>
          <item displayName="$(string.DH_Value4096)">
            <value>
              <decimal value="4096" />
            </value>
          </item>
        </enum>
      </elements>
    </policy>
    <!-- PKCS -->
    <policy name="PKCS" class="Machine" displayName="$(string.PKCS)"
      explainText="$(string.PKCS_Help)" valueName="Enabled"
      key="SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\KeyExchangeAlgorithms\PKCS">
      <parentCategory ref="KeyEx" />
      <supportedOn ref="windows:SUPPORTED_WindowsUpdate" />
      <enabledValue>
        <decimal value="4294967295" />
      </enabledValue>
      <disabledValue>
        <decimal value="0" />
      </disabledValue>
    </policy>
    <policy name="PKCSClient" class="Machine" displayName="$(string.PKCSClient)"
      explainText="$(string.PKCSClient_Help)" presentation="$(presentation.PKCSClient)"
      key="SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\KeyExchangeAlgorithms\PKCS">
      <parentCategory ref="KeyEx" />
      <supportedOn ref="SUPPORTED_3174644" />
      <elements>
        <enum id="PKCSClient_MinLength" valueName="ClientMinKeyBitLength">
          <item displayName="$(string.PKCS_Value2048)">
            <value>
              <decimal value="2048" />
            </value>
          </item>
          <item displayName="$(string.PKCS_Value3072)">
            <value>
              <decimal value="3072" />
            </value>
          </item>
          <item displayName="$(string.PKCS_Value4096)">
            <value>
              <decimal value="4096" />
            </value>
          </item>
        </enum>
      </elements>
    </policy>
    <!-- Elliptic-Curve Diffie-Hellman -->
    <policy name="ECDH" class="Machine" displayName="$(string.ECDH)"
      explainText="$(string.ECDH_Help)" valueName="Enabled"
      key="SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\KeyExchangeAlgorithms\ECDH">
      <parentCategory ref="KeyEx" />
      <supportedOn ref="windows:SUPPORTED_WindowsVista" />
      <enabledValue>
        <decimal value="4294967295" />
      </enabledValue>
      <disabledValue>
        <decimal value="0" />
      </disabledValue>
    </policy>
    <!-- .NET Framework subsection -->
    <policy name="dotnet_strongname" class="Machine" displayName="$(string.dotnet_strongname)"
      explainText="$(string.dotnet_strongname_Help)" key="SOFTWARE\Microsoft\.NETFramework">
      <parentCategory ref="NETFrame" />
      <supportedOn ref="windows:SUPPORTED_Windows7" />
      <enabledList>
        <item key="SOFTWARE\Microsoft\.NETFramework" valueName="AllowStrongNameBypass">
          <value>
            <decimal value="0" />
          </value>
        </item>
        <item key="SOFTWARE\Wow6432Node\Microsoft\.NETFramework" valueName="AllowStrongNameBypass">
          <value>
            <decimal value="0" />
          </value>
        </item>
      </enabledList>
      <disabledList>
        <item key="SOFTWARE\Microsoft\.NETFramework" valueName="AllowStrongNameBypass">
          <value>
            <decimal value="1" />
          </value>
        </item>
        <item key="SOFTWARE\Wow6432Node\Microsoft\.NETFramework" valueName="AllowStrongNameBypass">
          <value>
            <decimal value="1" />
          </value>
        </item>
      </disabledList>
    </policy>
    <!-- .NET Framework 4 -->
    <policy name="dotnet4" class="Machine" displayName="$(string.dotnet4)"
      explainText="$(string.dotnet4_Help)" key="SOFTWARE\Microsoft\.NETFramework\v4.0.30319">
      <parentCategory ref="NETFrame" />
      <supportedOn ref="windows:SUPPORTED_Windows7" />
      <enabledList>
        <item key="SOFTWARE\Microsoft\.NETFramework\v4.0.30319" valueName="SchUseStrongCrypto">
          <value>
            <decimal value="1" />
          </value>
        </item>
        <item key="SOFTWARE\Microsoft\.NETFramework\v4.0.30319" valueName="SystemDefaultTlsVersions">
          <value>
            <decimal value="1" />
          </value>
        </item>
        <item key="SOFTWARE\Wow6432Node\Microsoft\.NETFramework\v4.0.30319"
          valueName="SchUseStrongCrypto">
          <value>
            <decimal value="1" />
          </value>
        </item>
        <item key="SOFTWARE\Wow6432Node\Microsoft\.NETFramework\v4.0.30319"
          valueName="SystemDefaultTlsVersions">
          <value>
            <decimal value="1" />
          </value>
        </item>
      </enabledList>
      <disabledList>
        <item key="SOFTWARE\Microsoft\.NETFramework\v4.0.30319" valueName="SchUseStrongCrypto">
          <value>
            <decimal value="0" />
          </value>
        </item>
        <item key="SOFTWARE\Microsoft\.NETFramework\v4.0.30319" valueName="SystemDefaultTlsVersions">
          <value>
            <decimal value="0" />
          </value>
        </item>
        <item key="SOFTWARE\Wow6432Node\Microsoft\.NETFramework\v4.0.30319"
          valueName="SchUseStrongCrypto">
          <value>
            <decimal value="0" />
          </value>
        </item>
        <item key="SOFTWARE\Wow6432Node\Microsoft\.NETFramework\v4.0.30319"
          valueName="SystemDefaultTlsVersions">
          <value>
            <decimal value="0" />
          </value>
        </item>
      </disabledList>
    </policy>
    <!-- .NET Framework 2 -->
    <policy name="dotnet2" class="Machine" displayName="$(string.dotnet2)"
      explainText="$(string.dotnet2_Help)" key="SOFTWARE\Microsoft\.NETFramework\v2.0.50727">
      <parentCategory ref="NETFrame" />
      <supportedOn ref="windows:SUPPORTED_WindowsUpdate" />
      <enabledList>
        <item key="SOFTWARE\Microsoft\.NETFramework\v2.0.50727" valueName="SchUseStrongCrypto">
          <value>
            <decimal value="1" />
          </value>
        </item>
        <item key="SOFTWARE\Microsoft\.NETFramework\v2.0.50727" valueName="SystemDefaultTlsVersions">
          <value>
            <decimal value="1" />
          </value>
        </item>
        <item key="SOFTWARE\Wow6432Node\Microsoft\.NETFramework\v2.0.50727"
          valueName="SchUseStrongCrypto">
          <value>
            <decimal value="1" />
          </value>
        </item>
        <item key="SOFTWARE\Wow6432Node\Microsoft\.NETFramework\v2.0.50727"
          valueName="SystemDefaultTlsVersions">
          <value>
            <decimal value="1" />
          </value>
        </item>
      </enabledList>
      <disabledList>
        <item key="SOFTWARE\Microsoft\.NETFramework\v2.0.50727" valueName="SchUseStrongCrypto">
          <value>
            <decimal value="0" />
          </value>
        </item>
        <item key="SOFTWARE\Microsoft\.NETFramework\v2.0.50727" valueName="SystemDefaultTlsVersions">
          <value>
            <decimal value="0" />
          </value>
        </item>
        <item key="SOFTWARE\Wow6432Node\Microsoft\.NETFramework\v2.0.50727"
          valueName="SchUseStrongCrypto">
          <value>
            <decimal value="0" />
          </value>
        </item>
        <item key="SOFTWARE\Wow6432Node\Microsoft\.NETFramework\v2.0.50727"
          valueName="SystemDefaultTlsVersions">
          <value>
            <decimal value="0" />
          </value>
        </item>
      </disabledList>
    </policy>
  </policies>
</policyDefinitions>