I've got a Windows 2008 R2 server with both TLS 1.1 and TLS 1.2 enabled (but TLS 1.0 disabled) in the registry. In other words, Enabled = 0xffffffff and DisabledByDefault = 0 under both the Client and Server subkeys of HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1 and TLS 1.2; both values are 0 for TLS 1.0.
IISCrypto confirms this configuration.
However, when I scan an IIS-based website on the server using Qualys SSL Labs, it reports that the server is supporting only TLS 1.2--which is is my goal, but I don't understand how this has happened, given that I haven't disabled TLS 1.1 in the registry. What can be causing SSL Labs to fail to establish communication with the website over TLS 1.1?