Skip to content

Instantly share code, notes, and snippets.

View albert-widjaja's full-sized avatar

Albert Widjaja albert-widjaja

3 followers · 131 following
View GitHub Profile
@richardhicks
richardhicks / Optimize-DomainControllerTlsCipherSuites.ps1
Last active March 22, 2024 18:53
Disable Insecure TLS Cipher Suites for LDAPS on Domain Controllers
# This Gist is a PowerShell script to set the SSL Cipher Suite Order Group Policy Object (GPO) for Windows Server 2016 and 2019/2022.
# Reference: https://www.dsinternals.com/en/active-directory-domain-controller-tls-ldaps/
# Security optmized cipher suite list for Windows Server 2019/2022
$Ciphers2022 = 'TLS_AES_256_GCM_SHA384,TLS_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256'
# Security optmized cipher suite list for Windows Server 2016
$Ciphers2016 = 'TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256'
$GpoName = 'Domain Controller Security Baseline'
@joegasper
joegasper / ConvertFrom-DN
Last active June 5, 2024 02:37
Convert between DistinguishedName and CanonicalName
#Updated ConvertFrom-DN to support container objects
function ConvertFrom-DN {
[cmdletbinding()]
param(
[Parameter(Mandatory, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)]
[ValidateNotNullOrEmpty()]
[string[]]$DistinguishedName
)
process {
@jbratu
jbratu / setupiisforsslperfectforwardsecrecy_v17.ps1
Last active July 17, 2024 02:12
Great powershell script for tightening HTTPS security on IIS and disabling insecure protocols and ciphers. Very useful on core installations.
# Copyright 2019, Alexander Hass
# https://www.hass.de/content/setup-microsoft-windows-or-iis-ssl-perfect-forward-secrecy-and-tls-12
#
# After running this script the computer only supports:
# - TLS 1.2
#
# Version 3.0.1, see CHANGELOG.txt for changes.
Write-Host 'Configuring IIS with SSL/TLS Deployment Best Practices...'
Write-Host '--------------------------------------------------------------------------------'
@lukehutton
lukehutton / EnableSchUseStrongCrypto.ps1
Last active May 7, 2024 07:15
http://msdn.microsoft.com/en-us/library/windows/desktop/aa379810(v=vs.85).aspx HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319\SchUseStrongCrypto Instructs Schannel to disable known weak cryptographic algorithms, cipher suites, and SSL/TLS protocol versions that may be otherwise enabled for better interoperability.
New-ItemProperty -path 'HKLM:\SOFTWARE\Microsoft\.NETFramework\v4.0.30319' -name 'SchUseStrongCrypto' -value 1 -PropertyType 'DWord' -Force | Out-Null