# Windows 2008 R2 - WinRM and disabling TLS 1.0

**URL:** <https://forum.ansible.com/t/windows-2008-r2-winrm-and-disabling-tls-1-0/20348>\
**Category:** Ansible Project\
**Tags:** windows\
**Created:** [January 26, 2016, 1:23am UTC](https://forum.ansible.com/t/windows-2008-r2-winrm-and-disabling-tls-1-0/20348 "2016-01-26T01:23:30Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Chris\_Carlson](https://avatars.discourse-cdn.com/v4/letter/c/e8c25b/32.png) [@Chris\_Carlson](https://forum.ansible.com/u/Chris_Carlson)\
**Post date:** [January 26, 2016, 1:23am UTC](https://forum.ansible.com/t/windows-2008-r2-winrm-and-disabling-tls-1-0/20348/1 "2016-01-26T01:23:30Z")

</div>

Recently, I’ve undertaken the task of PCI Compliance for several servers I manage. One of the recurring recommendations is to disable TLS 1.0 in favor of TLS 1.1/1.2.

The good news… Disabling TLS 1.0 on a group of servers is super easy using Ansible! Sadly, one of the side effects of disabling is that the WinRM connection in my Ansible scripts becomes completely broken afterward. After disabling, connecting to Windows servers results in the following error:

fatal: [10.0.20.20]: FAILED! =\> {“failed”: true, “msg”: “ERROR! ssl: 500 WinRMTransport. [Errno 54] Connection reset by peer”}

Re-enabling TLS 1.0 will correct the issue, but obviously it’s not ideal and I’m wondering what can be done… So, some questions:

1. Is TLS 1.0 required in Windows, or is it something in pywinrm package?
2. If TLS 1.0 must be used, is there an interim solution where it can be disabled for IIS (port 443) only? The only solutions I have found online disable it in the SCHANNEL/Protocols registry key, which then disables it system-wide in Windows
3. Has anyone run into this problem or discovered another workaround?

Thanks, looking forward to discussing!

-chris

---

<div class="post-metadata">

**Author:** ![j.r.hawkesworth](https://avatars.discourse-cdn.com/v4/letter/j/a3d4f5/32.png) [@j.r.hawkesworth](https://forum.ansible.com/u/j.r.hawkesworth)\
**Post date:** [January 27, 2016, 8:23am UTC](https://forum.ansible.com/t/windows-2008-r2-winrm-and-disabling-tls-1-0/20348/2 "2016-01-27T08:23:14Z")

</div>

Not hit this myself, but seems likely its coming for many of us.

Just wondering if bouncing the winrm service might fix this? or a Restart-Computer (I’d recommend the win\_reboot role on galaxy if it really does need a reboot) - so many things in windows still need a reboot ☹

I guess it will need to renegotiate after a change like this has been made.

Noticed this when I was searching around - [https://support.microsoft.com/en-us/kb/3080079](https://support.microsoft.com/en-us/kb/3080079) if remote desktop needed a change then maybe winrm does too? No idea at this point if they share any logic.

Please let us know if the restart does the trick

Jon

---

<div class="post-metadata">

**Author:** ![Yinidu\_Ponweera](https://avatars.discourse-cdn.com/v4/letter/y/eada6e/32.png) [@Yinidu\_Ponweera](https://forum.ansible.com/u/Yinidu_Ponweera)\
**Post date:** [November 14, 2017, 3:57am UTC](https://forum.ansible.com/t/windows-2008-r2-winrm-and-disabling-tls-1-0/20348/3 "2017-11-14T03:57:46Z")

</div>

Hi Chris,

I am having the same issue. Were you able to work around this

-yinidu