Is there a good way using Powershell to filter from a multi-string value on a Windows 2019 Server?

71 views Asked by At

I've been working on remediation of some known security issues on some servers. This is one of the first times I've attempted this in a registry, so please excuse the sloppiness of the attempt. One of the issues involves remediating SSL encryption issues involving keys containing 3DES and RC4 located inside a multi-string key named 'Function' at the following location:

HKLM:\SYSTEM\CurrentControlSet\Control\Cryptography\Configuration\Local\SSL\00010002

What I'm attempting to do (I'm going to severely shorten the list), if the initial value were as follows:

TLS_AES_256_GCM_SHA384
TLS_AES_128_GCM_SHA256
TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
TLS_RSA_WITH_3DES_EDE_CBC_SHA
TLS_DHE_DSS_WITH_AES_256_CBC_SHA256
TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA
TLS_RSA_WITH_RC4_128_SHA

After running the script, the desired result would be the new value of this key would be:

TLS_AES_256_GCM_SHA384
TLS_AES_128_GCM_SHA256
TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
TLS_DHE_DSS_WITH_AES_256_CBC_SHA256

Among the different approaches I've tried, was the following script which is based on some Powershell script code I found here. Problem is, it isn't getting me anywhere, as it errored out. Ideally, I'd like to be able to search for anything with 3DES and RC4, but I focused initially on one of the two before complicating with multiple values.

#get the MultiLine String Array from the registry
$regArry = (Get-Itemproperty     "HKLM:\SYSTEM\CurrentControlSet\Control\Cryptography\Configuration\Local\SSL\00010002" -name "Functions").("Functions")

#Create a new String Array
[String[]]$tempArry = @()

#Create an ArrayList from the Registry Array so I can edit it
$tempArryList = New-Object System.Collections.Arraylist(,$regArry)

# remove an entry from the list
if ( $tempArryList -contains "TLS_RSA_WITH_3DES_EDE_CBC_SHA" )
{   
$tempArryList.Remove("TLS_RSA_WITH_3DES_EDE_CBC_SHA")
}

# Remove the old Array from the Registry
(Remove-ItemProperty     "HKLM:\SYSTEM\CurrentControlSet\Control\Cryptography\Configuration\Local\SSL\00010002" -name "Functions").    ("Functions")

# Add the new one
New-itemproperty "HKLM:\SYSTEM\CurrentControlSet\Control\Cryptography\Configuration\Local\SSL\00010002" -name "Functions" -PropertyType MultiString -Value "$tempArry"
0

There are 0 answers