It is my understanding that IIS has ssl v2 enabled by default. Also, TLS 1.0, if enabled, allows for at least one known major vulnerability titled "beast attack".
If the weak and vulnerable ciphers are disabled from the server is there known cons from application or users perspective?