I have been given a task to disable all "weak" ciphers/protocols on our very old ISA server based on Windows Server 2003. I have disabled all protocols but TLS1.0, and all ciphers but RC2/128, RC4/128 and Triple DES 168/168. But Qualys SSL Labs test utility does not display me that I have a 3DES encryption available on my ISA server. The only cipher suites listed are:

TLS_RSA_WITH_RC4_128_MD5 (0x4)  
TLS_RSA_WITH_RC4_128_SHA (0x5) 

This KB says that when Triple DES 168 cipher is enabled, the TLS_RSA_WITH_3DES_EDE_CBC_SHA cipher suite is available. However, it is not. We need this cipher suite to allow a Windows 8.1 Phone connecting to ActiveSync published by this ISA. What could be the reason of 3DES encryption to be unavailable in this configuration, and what should we do in order to allow the connection for a Windows 8.1 phone without being vulnerable to POODLE?

EDIT: There was apparently a server-side malfunction of some sort, a reboot fixed 3DES availability, although the same KB states that registry change should have worked at once. I've got another server with the same problem, got it fixed with registry modification only, though.

  • And I hope you're ready to decommission that thing. It goes out of support in a few months. Oct 22, 2014 at 13:35
  • NO :D While the ISA server is about to get decommissioned indeed, the other server is about to last a few more years.
    – Vesper
    Oct 23, 2014 at 4:57
  • 1
    You should not be planning to run Server 2003 for "a few more years"! Oct 23, 2014 at 12:31
  • ME? No, my BOSS plans to. While I agree about it should be migrated away to more modern platforms, the actual decision hits money wall.
    – Vesper
    Oct 24, 2014 at 5:28
  • He's gonna have to pay a hell of a lot more money when you guys inevitably get hacked, sued, and/or your application breaks. I've attached a rough cost justification as to what may happen should your ISA server be compromised: origin.ih.constantcontact.com/fs195/1118397859495/img/18.gif Jul 9, 2015 at 5:06

2 Answers 2


If your registry change didn't take effect immediately, then just restart your computer.

  • That'll be a good solution if that restart won't impact other users en masse. Still, a restart of any Windows system is likely to fix many problems.
    – Vesper
    Oct 23, 2014 at 4:58
  • Still, a restart indeed fixed this stupid problem.
    – Vesper
    Jul 9, 2015 at 6:40

Triple DES 168 worked for me and disabled TLS_RSA_WITH_3DES_EDE_CBC_SHA cipher

DisabledByDefault --> 1 Enabled --> 0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.