40-bit RC4 Cipher will not disable

i'm not missing here, 40bit rc4 ciphers not disable.

i have exported , diffed servers registry keys another, cipher disabled properly. if server ignoring registry key.

here registry export

[hkey_local_machine\system\currentcontrolset\control\securityproviders\schannel]
"eventlogging"=dword:00000001

[hkey_local_machine\system\currentcontrolset\control\securityproviders\schannel\ciphers]

[hkey_local_machine\system\currentcontrolset\control\securityproviders\schannel\ciphers\des 56]
"enabled"=dword:00000000

[hkey_local_machine\system\currentcontrolset\control\securityproviders\schannel\ciphers\des 56/56]
"enabled"=dword:00000000

[hkey_local_machine\system\currentcontrolset\control\securityproviders\schannel\ciphers\null]
"enabled"=dword:00000000

[hkey_local_machine\system\currentcontrolset\control\securityproviders\schannel\ciphers\rc2 128/128]
@=""
"enabled"=dword:ffffffff

[hkey_local_machine\system\currentcontrolset\control\securityproviders\schannel\ciphers\rc2 40/128]
"enabled"=dword:00000000

[hkey_local_machine\system\currentcontrolset\control\securityproviders\schannel\ciphers\rc2 56/128]
"enabled"=dword:00000000

[hkey_local_machine\system\currentcontrolset\control\securityproviders\schannel\ciphers\rc4 128/128]
@=""
"enabled"=dword:ffffffff

[hkey_local_machine\system\currentcontrolset\control\securityproviders\schannel\ciphers\rc4 40/128]
"enabled"=dword:00000000

[hkey_local_machine\system\currentcontrolset\control\securityproviders\schannel\ciphers\rc4 56/128]
"enabled"=dword:00000000

[hkey_local_machine\system\currentcontrolset\control\securityproviders\schannel\ciphers\rc4 64/128]
"enabled"=dword:00000000

[hkey_local_machine\system\currentcontrolset\control\securityproviders\schannel\ciphersuites]

[hkey_local_machine\system\currentcontrolset\control\securityproviders\schannel\hashes]

[hkey_local_machine\system\currentcontrolset\control\securityproviders\schannel\hashes\sha]
@=""
"enabled"=dword:ffffffff

[hkey_local_machine\system\currentcontrolset\control\securityproviders\schannel\keyexchangealgorithms]

[hkey_local_machine\system\currentcontrolset\control\securityproviders\schannel\protocols]

[hkey_local_machine\system\currentcontrolset\control\securityproviders\schannel\protocols\pct 1.0]

[hkey_local_machine\system\currentcontrolset\control\securityproviders\schannel\protocols\pct 1.0\server]
"enabled"=dword:00000000

[hkey_local_machine\system\currentcontrolset\control\securityproviders\schannel\protocols\ssl 2.0]

[hkey_local_machine\system\currentcontrolset\control\securityproviders\schannel\protocols\ssl 2.0\client]
"disabledbydefault"=dword:00000001
"enabled"=dword:00000000

[hkey_local_machine\system\currentcontrolset\control\securityproviders\schannel\protocols\ssl 2.0\server]
"enabled"=dword:00000000

[hkey_local_machine\system\currentcontrolset\control\securityproviders\schannel\protocols\ssl 3.0]

[hkey_local_machine\system\currentcontrolset\control\securityproviders\schannel\protocols\ssl 3.0\client]
"enabled"=dword:00000001

[hkey_local_machine\system\currentcontrolset\control\securityproviders\schannel\protocols\ssl 3.0\server]
"enabled"=dword:00000001

[hkey_local_machine\system\currentcontrolset\control\securityproviders\schannel\protocols\tls 1.0]

[hkey_local_machine\system\currentcontrolset\control\securityproviders\schannel\protocols\tls 1.0\client]
"enabled"=dword:00000001

[hkey_local_machine\system\currentcontrolset\control\securityproviders\schannel\protocols\tls 1.0\server]
"enabled"=dword:00000001

and here sslscan results:

c:\users\mark\downloads\sslscan-1.8.2-win-r7>sslscan.exe prodweb | findstr accept
    accepted  sslv3  168 bits  des-cbc3-sha
    accepted  sslv3  128 bits  rc4-sha
    accepted  sslv3  128 bits  rc4-md5
    accepted  sslv3   40 bits  exp-rc4-md5
    accepted  tlsv1  256 bits  aes256-sha
    accepted  tlsv1  128 bits  aes128-sha
    accepted  tlsv1  168 bits  des-cbc3-sha
    accepted  tlsv1  128 bits  rc4-sha
    accepted  tlsv1  128 bits  rc4-md5
    accepted  tlsv1   40 bits  exp-rc4-md5

what gets me have exact matching registry entries on server in qa, , works fine.

c:\users\mark\downloads\sslscan-1.8.2-win-r7>sslscan.exe qaweb| findstr accept
    accepted  sslv3  128 bits  rc4-sha
    accepted  sslv3  128 bits  rc4-md5
    accepted  tlsv1  256 bits  aes256-sha
    accepted  tlsv1  128 bits  aes128-sha
    accepted  tlsv1  128 bits  rc4-sha
    accepted  tlsv1  128 bits  rc4-md5

any suggestions before shell out $300 support case?

thanks!

mark

after disable cipher, may need restart iis apply change. http://support.microsoft.com/kb/245030

Windows Server  >  Security