title: What is the difference between the DisabledByDefault and Enabled SSL/TLS registry keys on Microsoft Windows?
body: <p>Microsoft provides best practices guidance for Transport Layer Security (TLS). This document describes registry keys that can enable or disable a specific protocol.</p>
  
  <p><a href="https://docs.microsoft.com/en-us/dotnet/framework/network-programming/tls#configuring-schannel-protocols-in-the-windows-registry" rel="noreferrer">https://docs.microsoft.com/en-us/dotnet/framework/network-programming/tls#configuring-schannel-protocols-in-the-windows-registry</a></p>
  
  <p>For example, to enable TLS 1.2, you can add the following registry keys. </p>
  
  <pre><code>[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client]
  "DisabledByDefault"=dword:00000000
  "Enabled"=dword:FFFFFFFF
  
  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server]
  "DisabledByDefault"=dword:00000000
  "Enabled"=dword:FFFFFFFF
  </code></pre>
  
  <p>What is the difference between <code>DisabledByDefault</code> and <code>Enabled</code>? They seem redundant.</p>