Enforce FIPS Cryptography Globally via Regedit

This guide provides a direct walkthrough on how to enforce Federal Information Processing Standards (FIPS) 140-validated cryptographic algorithms across a Windows system using the Registry Editor (Regedit). Enabling this policy ensures that the operating system and supported third-party applications exclusively use FIPS-compliant algorithms for encryption, hashing, and signing.

Prerequisites and Considerations

• Administrative Privileges: You must run the Registry Editor as an Administrator.
• Compatibility: Enforcing FIPS may cause legacy applications, older .NET applications, or non-compliant web browsers to fail if they rely on non-approved cryptographic algorithms (such as MD5 or RC4).

Step-by-Step Instructions to Enable FIPS via Regedit

1. Open the Registry Editor
   • Press Win + R to open the Run dialog box.
   • Type regedit and press Enter (or click OK).
   • Click Yes when prompted by User Account Control (UAC).
2. Navigate to the LSA Policy Key

   • In the address bar at the top of the Registry Editor, paste the following path and press Enter:

     HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\FipsAlgorithmPolicy

   • Note: If the FipsAlgorithmPolicy key does not exist under Lsa, right-click the Lsa folder, select New > Key, and name it FipsAlgorithmPolicy.

3. Modify the Enabled Value
   • Locate the DWORD (32-bit) value named Enabled in the right-hand pane.
   • If the Enabled entry does not exist:
     1. Right-click anywhere in the empty space of the right pane.
     2. Select New > DWORD (32-bit) Value.
     3. Name the new value Enabled.
   • Double-click Enabled to edit its properties.
   • Under Value data, change the value from 0 to 1.
   • Ensure the Base is set to Hexadecimal.
   • Click OK.
4. Restart the System
   • Close the Registry Editor.
   • Restart your computer or server to apply the cryptographic restrictions globally.

Verifying FIPS Enforcement

To verify that the FIPS policy is active after the restart:

1. Open PowerShell as an Administrator.

2. Run the following command:

   Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\FipsAlgorithmPolicy" -Name "Enabled"

3. A return value of Enabled : 1 confirms that FIPS-compliant cryptographic algorithms are being globally enforced. To disable FIPS in the future, set the Enabled registry value back to 0 and reboot the machine.