Description
Scope
All Windows Agent Manager and Windows Agents
Solution
This article describes how to disable FIPS in Windows operating system. FIPS mode is a federal requirement for machines that run on government agencies that have sensitive data which protocol and security measures that protect the data are approved by the US government.
The purpose of this article is to explain how to disable these features on a windows server and allow users to bypass FIPS. FIPS compliant windows servers interfere with the operations/installation of Windows Agent Manager and the Windows Agent itself. FIPS uses certain protocols to allow connections, there is currently no work-around other than to disable FIPS operations from the windows server. This will allow the continuation of operating the Windows Agent Manager.
Windows Agent Manager will receive a “Failed to Add FortiSiem service connection to registry” as a result of FIPS being turned on. FIPS protects the registry from being edited by non FIPS compliant Software. Microsoft reference links and blog notes (below) explain how to verify the solution. Microsoft has recommended to turn off FIPS mode for any future usage of windows.
Scope
All Windows Agent Manager and Windows Agents
Solution
To disable FIPS in Windows:
1. From 'Run' type gpedit.msc, it will open 'Local Group Policy Editor'.
2. Navigate to 'Local Computer Policy > Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options' in the left pane.
3. Click on 'Security Options' and then select 'System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing' in the right pane.
4. Right-click on this option (System cryptography) and click on 'Properties'.
5. From the 'Properties' dialog, select 'Disabled' radio button under 'Local Security Setting' page.
6. Restart the PC.
Additional Notes:
Microsoft KB 811833 will describe this for further information:
As of 2014, Microsoft has recommended to turn off FIPS mode as well.
https://blogs.technet.microsoft.com/secguide/2014/04/07/why-were-not-recommending-fips-mode-anymore/
