This article describes how to add support for stronger Advanced Encryption Standard (AES) cipher suites in Windows Server 2003 Service Pack 2 (SP2) and how to disable weaker ciphers.
Step 1: To add support for stronger AES cipher suites in Windows Server 2003 SP2, apply the update that is described in the following article in the Microsoft Knowledge Base:
948963 An update is available to add support for the TLS_RSA_WITH_AES_128_CBC_SHA AES128-SHA and TLS_RSA_WITH_AES_256_CBC_SHA AES256-SHA AES cipher suites in Windows Server 2003
Step 2: To disable weak ciphers (including EXPORT ciphers) in Windows Server 2003 SP2, follow these steps.
ImportantThis section, method, or task contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, click the following article number to view the article in the Microsoft Knowledge Base:
322756How to back up and restore the registry in Windows
To edit these registry values, follow these steps:
Click Start, click Run, type regedit in the Open box, and then click OK.
Locate and then click the following subkey in the registry:
On the Edit menu, point to New, and then click Key. Type the name of the key according to the following cipher names:
On the Edit menu, point to New, and then click DWORD Value.
Type Enabled for the name of the DWORD, and then press ENTER.
Right-click Enabled, and then click Modify.
In the Value data box, type 00000000, and then click OK.
On the File menu, click Exit to quit Registry Editor.
Note Repeat these steps to disable each weak cipher.
In order of preference, the cipher suites that are available after you successfully follow these steps are as follows: