Fix TLS 1.3 support detection in Health Checker#2551
Merged
Conversation
- Wrap Where-Object results in @() for reliable .Count in PS 5.1 - Add support check to TLS 1.3 warning so it only fires on unsupported OS/Exchange - Add Write-Verbose for TLS 1.3 support variable debugging
Member
Author
|
/azp run |
|
Azure Pipelines successfully started running 1 pipeline(s). |
Contributor
There was a problem hiding this comment.
Pull request overview
This PR updates HealthChecker’s Invoke-AnalyzerSecuritySettings TLS 1.3 detection so the “TLS 1.3 not disabled” warning is only emitted when the current OS and/or Exchange build does not support TLS 1.3, preventing false-positive warnings on supported configurations.
Changes:
- Adds verbose logging to surface OS/Exchange TLS 1.3 support inputs during troubleshooting.
- Makes several
Where-Objectresult counts deterministic by wrapping results in@(...)before using.Count. - Guards the “TLS 1.3 not disabled” warning so it triggers only when TLS 1.3 is enabled/not disabled on an unsupported OS/Exchange combination.
lusassl-msft
approved these changes
Jun 11, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes TLS 1.3 support detection in
Invoke-AnalyzerSecuritySettingsso that the warning message is only displayed when the OS/Exchange version does not support TLS 1.3.Changes
.Countfix: WrappedWhere-Objectfilter results in@()array subexpression to ensure.Countreturns a reliable value in PowerShell 5.1 (single objects don't have a.Countproperty in 5.1, causing the filter to silently return\).(-not \ -or -not \)check to the TLS 1.3 warning block (line 233) so the error message only fires when TLS 1.3 is not supported on the current OS and Exchange version combination. Previously this warning fired unconditionally whenever TLS 1.3 was not disabled, even on supported configurations (e.g., Exchange SE RTM on Windows Server 2025).