title: Is there a resolution to nmap ssl-enum-ciphers not returning all TLS 1.2 cipher suites?
body: <p>Microsoft lists 36 cipher suites available to TLS 1.2 protocol enabled in a vanilla installation of Windows Server 2016 Build 1607:</p>
  <ul>
  <li>excludes 2 cipher suites available only used when an application explicitly requests</li>
  <li>source: <a href="https://docs.microsoft.com/en-us/windows/win32/secauthn/tls-cipher-suites-in-windows-10-v1607" rel="nofollow noreferrer">https://docs.microsoft.com/en-us/windows/win32/secauthn/tls-cipher-suites-in-windows-10-v1607</a></li>
  </ul>
  <p>Accounting for enabled=false Ciphers and KeyExchangeAlgorithms (registry HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL), and verifying that Cipher Suite Order and Elliptic Curve Order is default (gpedit.msc), the list of enabled cipher suites is reduced to 32.</p>
  <p>Why does nmap 7.9.1 return only 10 cipher suites?</p>
  <pre><code>nmap --script ssl-enum-ciphers -p3389 TestServerName.domain.tld
  
  results
  4 x TLS_DHE_RSA_WITH_AES_*, and
  6 x TLS_ECDHE_RSA_WITH_AES_*
  </code></pre>
  <p>The most recent update on nmap.org thread &quot;ssl-enum-ciphers not returning all ciphers&quot; is July 23, 2019:  <a href="https://seclists.org/nmap-dev/2019/q3/4" rel="nofollow noreferrer">https://seclists.org/nmap-dev/2019/q3/4</a></p>
  <p>Has anyone resolved this issue?</p>
  <p>PS There is a difference of TLS version in a single network trace frame (shown below) and I'm not certain if this is part of the issue or unrelated.</p>
  <p><a href="https://i.stack.imgur.com/oesH8.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/oesH8.png" alt="NetMon trace results: ClientHello shows two TLS versions" /></a></p>