This message was deleted.

Sure the scanners not picking up tls 1.2 ? also I think a lot of users use something called IISCrypto which is a bit of a stupid name for what it does - not used it myself, also adding SchUseStrongCrypto to the registry makes applications user stronger versions of TLS, apparently the IISCrypto is applicable to client machines , possibly a branding issue there

In fact it works. No more vulnerability. Great admx, two restart