I have several IIS servers in house This includes IIS 6 and 7.x. When I have my external PCI scans run I'm still receiving alerts for having the weak protocol DES-CBC-SHA enabled.
I have the following registry keys set to disable weak protocols. My understanding was that shutting this protocol off this was included under the DES entry on the top line.
HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL Ciphers/DES 56/56: Enabled=0 Ciphers/RC2 40/128: Enabled=0 Ciphers/RC4 40/128: Enabled=0 Protocols/SSL 2.0/Server: Enabled=0 Protocols/PCT 1.0/Server: Enabled=0
My report indicates that this protocol is enabled for both TLSv1 and SSLv3.
What if anything am I missing in my settings that would make this display? How can I diagnose this internally to verify the scan is accurate?