Enforce FIPS Cryptography in Windows via Regedit

Enforcing Federal Information Processing Standards (FIPS) mode in Windows ensures that the operating system and supported applications strictly use FIPS 140-validated cryptographic algorithms for encryption, hashing, and signing. This article provides a step-by-step guide on how to configure the Windows Registry using the Registry Editor (regedit) to enable FIPS compliance across your system.

The Registry Path and Value

To control the FIPS policy setting, modify the following registry location:

• Key Path: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\FipsAlgorithmPolicy
• Value Name: Enabled
• Value Type: REG_DWORD
• Value Data:
  • 1 = Enforce FIPS compliance (Enabled)
  • 0 = Standard mode (Disabled)

Step-by-Step: Enabling FIPS via Registry Editor

1. Open Registry Editor:
   • Press Windows Key + R to open the Run dialog.
   • Type regedit and press Enter.
   • Click Yes if prompted by User Account Control (UAC).
2. Navigate to the Target Key:

   • In the address bar or navigation tree on the left, navigate to:

     HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\FipsAlgorithmPolicy

   • Note: If the FipsAlgorithmPolicy key does not exist under Lsa, right-click Lsa, select New > Key, and name it FipsAlgorithmPolicy.

3. Modify the Enabled DWORD:
   • In the right-hand pane, locate the Enabled value.
   • If Enabled does not exist, right-click an empty space in the right pane, select New > DWORD (32-bit) Value, and name it Enabled.
   • Double-click Enabled.
   • Set the Base to Hexadecimal (or Decimal).
   • Change the Value data to 1.
   • Click OK.
4. Restart the System:
   • Close the Registry Editor.
   • Restart your computer to apply the cryptographic enforcement system-wide.

Enabling FIPS via Command Line (Alternative)

You can also apply this registry change directly via an elevated Command Prompt or PowerShell without manually browsing the registry tree:

reg add "HKLM\SYSTEM\CurrentControlSet\Control\Lsa\FipsAlgorithmPolicy" /v "Enabled" /t REG_DWORD /d 1 /f

After running the command, restart the system to activate the policy.