Server 2016 Essentials and 2016 Standard. Both have Essentials Dashboard.
Windows 11 clients updated automatically to 24H2. Once done all showed Offline under Devices. Checked the clients and they all showed they had connection to server, but Network no longer showed any of the other PCs on the Network. Network files were still available from each client.
Searched for a solution and found a number of users having similar issues with Network connection. Only solution was to Roll Back each client to 23H2 and set Group Policy to only allow updates to 23H2. This worked but Devices now show Updates needed for each. When run Updates manually on Clients no updates found.
Not a long-term solution as should be able to update to 24H2 as any new clients will have that version.
Hello Kent,
This issue likely pertains to TLS. I've attached a zipped PowerShell script. Running it from an elevated PowerShell prompt will provide an overview of the TLS settings on your server. Could you share the output here?
PS C:\Users\Admin\Desktop\Get-TLS1> C:\Users\Admin\Desktop\Get-TLS1\Get-TLS.ps1 Path Name Value ---- ---- ----- HKLM:\SOFTWARE\Microsoft\.NETFramework\v4.0.30319 SystemDefaultTlsVersions 1 HKLM:\SOFTWARE\Microsoft\.NETFramework\v4.0.30319 SchUseStrongCrypto 1 HKLM:\SOFTWARE\WOW6432Node\Microsoft\.NETFramework\v4.0.30319 SystemDefaultTlsVersions 1 HKLM:\SOFTWARE\WOW6432Node\Microsoft\.NETFramework\v4.0.30319 SchUseStrongCrypto 1 HKLM:\SOFTWARE\Microsoft\.NETFramework\v2.0.50727 SystemDefaultTlsVersions 1 HKLM:\SOFTWARE\Microsoft\.NETFramework\v2.0.50727 SchUseStrongCrypto 1 HKLM:\SOFTWARE\WOW6432Node\Microsoft\.NETFramework\v2.0.50727 SystemDefaultTlsVersions 1 HKLM:\SOFTWARE\WOW6432Node\Microsoft\.NETFramework\v2.0.50727 SchUseStrongCrypto 1 HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.3\Server Enabled Not Found HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.3\Server DisabledByDefault Not Found HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.3\Client Enabled Not Found HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.3\Client DisabledByDefault Not Found HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server Enabled Not Found HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server DisabledByDefault Not Found HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client Enabled 1 HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client DisabledByDefault 0 HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server Enabled Not Found HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server DisabledByDefault Not Found HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Client Enabled Not Found HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Client DisabledByDefault Not Found HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server Enabled Not Found HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server DisabledByDefault Not Found HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Client Enabled Not Found HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Client DisabledByDefault Not Found PS C:\Users\Admin\Desktop\Get-TLS1>
It's unusual to find that 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client' is set to 1 while the others are not configured. I suggest downloading Nartac Software - IIS Crypto and following the steps shown in the screenshots. Start by creating a backup, then reset to defaults. Afterwards, you'll need to reboot the server. Revisit the Dashboard to see if there's any improvement. If not, open a browser and navigate to 'http://servername/connect' to reinstall the Connector.
Thank you. Will try this tonight after business hours and let you know.
Ran the program twice and rebooted. No change in the values other than Not Found changed to und.
Path Name Val ue ---- ---- --- HKLM:\SOFTWARE\Microsoft\.NETFramework\v4.0.30319 SystemDefaultTlsVersions 1 HKLM:\SOFTWARE\Microsoft\.NETFramework\v4.0.30319 SchUseStrongCrypto 1 HKLM:\SOFTWARE\WOW6432Node\Microsoft\.NETFramework\v4.0.30319 SystemDefaultTlsVersions 1 HKLM:\SOFTWARE\WOW6432Node\Microsoft\.NETFramework\v4.0.30319 SchUseStrongCrypto 1 HKLM:\SOFTWARE\Microsoft\.NETFramework\v2.0.50727 SystemDefaultTlsVersions 1 HKLM:\SOFTWARE\Microsoft\.NETFramework\v2.0.50727 SchUseStrongCrypto 1 HKLM:\SOFTWARE\WOW6432Node\Microsoft\.NETFramework\v2.0.50727 SystemDefaultTlsVersions 1 HKLM:\SOFTWARE\WOW6432Node\Microsoft\.NETFramework\v2.0.50727 SchUseStrongCrypto 1 HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.3\Server Enabled und HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.3\Server DisabledByDefault und HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.3\Client Enabled und HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.3\Client DisabledByDefault und HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server Enabled und HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server DisabledByDefault und HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client Enabled 1 HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client DisabledByDefault 0 HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server Enabled und HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server DisabledByDefault und HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Client Enabled und HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Client DisabledByDefault und HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server Enabled und HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server DisabledByDefault und HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Client Enabled und HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Client DisabledByDefault und
I have attached a zipped registry file containing the default settings for Windows Server 2016 Essentials. While I am skeptical it will resolve the issue, feel free to attempt it. Alternatively, execute the following script to temporarily disable TLS 1.2, then proceed to reinstall the Connector software. Keep in mind, should you choose to reinstall the Connector, a reboot is required after uninstallation before attempting a new installation.
If (-Not (Test-Path 'HKLM:\SOFTWARE\WOW6432Node\Microsoft\.NETFramework\v4.0.30319')) { New-Item 'HKLM:\SOFTWARE\WOW6432Node\Microsoft\.NETFramework\v4.0.30319' -Force | Out-Null } New-ItemProperty -Path 'HKLM:\SOFTWARE\WOW6432Node\Microsoft\.NETFramework\v4.0.30319' -Name 'SystemDefaultTlsVersions' -Value '0' -PropertyType 'DWord' -Force | Out-Null New-ItemProperty -Path 'HKLM:\SOFTWARE\WOW6432Node\Microsoft\.NETFramework\v4.0.30319' -Name 'SchUseStrongCrypto' -Value '0' -PropertyType 'DWord' -Force | Out-Null If (-Not (Test-Path 'HKLM:\SOFTWARE\Microsoft\.NETFramework\v4.0.30319')) { New-Item 'HKLM:\SOFTWARE\Microsoft\.NETFramework\v4.0.30319' -Force | Out-Null } New-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\.NETFramework\v4.0.30319' -Name 'SystemDefaultTlsVersions' -Value '0' -PropertyType 'DWord' -Force | Out-Null New-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\.NETFramework\v4.0.30319' -Name 'SchUseStrongCrypto' -Value '0' -PropertyType 'DWord' -Force | Out-Null If (-Not (Test-Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server')) { New-Item 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server' -Force | Out-Null } New-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server' -Name 'Enabled' -Value '0' -PropertyType 'DWord' -Force | Out-Null New-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server' -Name 'DisabledByDefault' -Value '1' -PropertyType 'DWord' -Force | Out-Null If (-Not (Test-Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client')) { New-Item 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client' -Force | Out-Null } New-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client' -Name 'Enabled' -Value '0' -PropertyType 'DWord' -Force | Out-Null New-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client' -Name 'DisabledByDefault' -Value '1' -PropertyType 'DWord' -Force | Out-Null Write-Host 'TLS 1.2 has been disabled. You must restart the Windows Server for the changes to take affect.' -ForegroundColor Cyan
The issues with the Dashboard, the Anywhere Access wizard, and Windows 11 clients using the Connector software are all related to a mismatch in the expected TLS versions. At present, it is necessary to completely disable TLS 1.0 and 1.1 and enforce TLS 1.2 to successfully run the Access Anywhere wizard, as it connects to a Microsoft server that only permits TLS 1.2. However, this action causes client computers to encounter failures when installing the Connector or appearing in the dashboard, as the Connector requires TLS 1.0 or 1.1 to be enabled.
However, I have the Essentials dashboard and the latest version of Windows 11 operating in my lab, so there is a solution to this issue; we just need to discover it.
Thank you. I'll be waiting for weekend to do this. Will keep you posted.
Found a solution. Did the following on each Win 11 PC. After making the changes uninstalled the connector, left the domain back to Workgroup. Updated to Win 11 24H2. Once updated reran the Connector and rejoined the Domain. Before doing this, I did setup a Test client with Policy fix in place. It connected without an issue.
From another source:
"What we found was an Encryption policy during GPO assignment was not deploying to devices.
The policy in question is located under the following location:
Local Computer Policy - Computer Configuration - Windows Settings - Security Settings - Local Policies - Security Options.
Policy is called Network Security: Configure Encryption types allowed for Kerberos. And we then enabled the following options to be applied from GPO:
RC4_HMAC_MD5
AES128_HMAC_SHA1
AES256_HMAC_SHA1
Future encryption types
Also, a good idea to check the following on the client side that is not joining and updating the reg key provided for it to receive the policy.
Also, a good idea to test this policy first before deploying to all devices.
On the client side
Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \Sofware\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters\ Value Name: SupportedEncryptionTypes Type: REG_DWORD Value: 1, 2, or 3 are a finding.
I will look into this but at first thought I see security related issues.
When you configure local policies related to Kerberos encryption types, you are setting parameters that affect which encryption algorithms are supported for Kerberos authentication. This can be done by modifying registry settings directly or using tools like secpol.msc to manage the local security policy.
When you change the SupportedEncryptionTypes registry value to 7FFFFFFC, you are directly modifying the Kerberos encryption types that are allowed. The specific value 7FFFFFFC corresponds to a bitmask that:
SupportedEncryptionTypes
7FFFFFFC
Local Policy Change Enabling RC4:
Registry Change to 7FFFFFFC:
Effect of the Registry Change:
What Happens Next:
In short, RC4 will no longer be used after the registry change to 7FFFFFFC, and only AES128 and AES256 will be allowed for Kerberos authentication. This is generally a good idea since RC4 is considered weak and vulnerable to cryptographic attacks.
I find it hard to believe that this alone will resolve the issue. It's far more likely that applying the changes I suggested earlier, along with uninstalling and reinstalling the connector, will actually fix it.
There were 5 Win 11 PCs that no longer showed Online in the Dashboard once they originally updated to 24H2. During my new upgrade process only 1 did not already have \Sofware\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters\ set to SupportedEncryptionTypes 7ffffffc.
I do have another server running 2016. It was updated from Essentials to Standard so the Dashboard is still active.
If I use your Default Registry file on this server will that be OK?
Is the Script to be run on the Server or Clients? If on the Server do I uninstall the Connector on all the affected PCs first or ok to do after.
Thanks for all this. I know I'm not the only one having issues.
The default registry file contains the default settings on each hive but it does not remove settings that were added manually. IISCrypto from Nartac Software - Download has an option to restore defaults on your server(s), that is what I would do. After resetting defaults I would uninstall the connector, reboot and install the connector. Pls, do not unjoin because that is not needed.
I never have these issues with the Connector.
Hello I tried all off this , but still no luck , windows 11 24h2 not correctly connecting to sbs 2016 , cant see in dashboard nor can i connect with anywhere access
Giorgio, Windows Server 2016 Essentials is no longer supported since Jan 11, 2022. I think something has changed in Windows 11 24H2 that makes this fail. I would migrate to Windows Server 2022 or 2025. Anything that could be done with the Essentials dashboard can be done with the native tools or Windows Admin Center. All our technician migration kits include a chapter on Windows Admin Center.