Objective
To resolve download failures caused by network proxies blocking Automox traffic when endpoints default to legacy TLS protocols (TLS 1.0/1.1) instead of TLS 1.2+.
Problem / Symptoms
When attempting to download software installers, patches, or Worklet payloads, file downloads fail on the endpoint.
The Automox Agent log (amagent.log) records errors similar to the following:
Plaintext
Download of C:\Windows\TEMP\file.exe failed
Error: Exception calling "DownloadFile" with "2" argument(s): "The operation has timed out"
Root Cause
Many network security proxies enforce strict security policies that block HTTP/HTTPS traffic using TLS 1.0 or 1.1.
On Windows endpoints running legacy .NET Framework configurations or PowerShell versions prior to 5.1, the underlying .NET runtime defaults to legacy TLS protocols during WebClient file download operations. When these requests traverse an inspection proxy, the proxy drops the connection due to protocol non-compliance, resulting in operation timeouts.
Resolution Steps
1.Enable Strong Cryptography in .NET Framework:
Run PowerShell as an Administrator and execute the following commands to enforce strong cryptography and system-default TLS 1.2 settings across 32-bit and 64-bit .NET Framework runtimes:
PowerShell
# 64-bit / System-Wide .NET Framework Settings
Set-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\.NETFramework\v2.0.50727' -Name 'SystemDefaultTlsVersions' -Value 1 -Type DWord
Set-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\.NETFramework\v2.0.50727' -Name 'SchUseStrongCrypto' -Value 1 -Type DWord
Set-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\.NETFramework\v4.0.30319' -Name 'SystemDefaultTlsVersions' -Value 1 -Type DWord
Set-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\.NETFramework\v4.0.30319' -Name 'SchUseStrongCrypto' -Value 1 -Type DWord
# 32-bit (WOW64) .NET Framework Settings
Set-ItemProperty -Path 'HKLM:\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\v2.0.50727' -Name 'SystemDefaultTlsVersions' -Value 1 -Type DWord
Set-ItemProperty -Path 'HKLM:\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\v2.0.50727' -Name 'SchUseStrongCrypto' -Value 1 -Type DWord
Set-ItemProperty -Path 'HKLM:\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\v4.0.30319' -Name 'SystemDefaultTlsVersions' -Value 1 -Type DWord
Set-ItemProperty -Path 'HKLM:\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\v4.0.30319' -Name 'SchUseStrongCrypto' -Value 1 -Type DWord
2.Disable Insecure Ciphers via SCHANNEL:
Ensure insecure ciphers (such as NULL) are disabled and modern ciphers (such as AES-256) are explicitly enabled in SCHANNEL:
PowerShell
# Disable NULL Cipher
New-Item -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\NULL' -Force | Out-Null
Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\NULL' -Name 'Enabled' -Value 0 -Type DWord
# Enable AES 256/256 Cipher
New-Item -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\AES 256/256' -Force | Out-Null
Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\AES 256/256' -Name 'Enabled' -Value 4294967295 -Type DWord
3.Restart the Device:
Reboot the endpoint to ensure all SCHANNEL registry changes and .NET Framework security settings take effect across system services and the Automox Agent process.
Verification Steps
-
Test TLS Protocol Capability: Use a diagnostic tool or execute the following PowerShell command to verify TLS 1.2 connection negotiation:
PowerShell
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 Invoke-WebRequest -Uri "https://console.automox.com" -UseBasicParsing Inspect Proxy Logs: Confirm that file download requests originating from
amagent.exeare passing through the network proxy without protocol mismatch flags.Review Agent Logs: Check
C:\ProgramData\amagent\amagent.logto ensure patch downloads succeed without timeout exceptions.