Systems Management

In the SMA, go to Scripting -> Scripts -> Choose Action -> New

Fill in the fields and be sure to select Windows for the Operating System.  Also limit the devices to the scope you'd like to target.

Click "New Task" and under Verify, click "Add" and select Verify a registry value is not...

Key: HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server
Name: DisabledByDefault
Not Equal To: 1

Once you do that, click Add again under Verify (repeat this until you've created "Verify a registry value is not..." for all the below):

Key: HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server
Name: Enabled
Not Equal To: 0

Key: HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Client
Name: DisabledByDefault
Not Equal To: 1

Key: HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Client
Name: Enabled
Not Equal To: 0

So the above makes sure that this wasn't already done to save the effort from trying to modify the registry twice.

Next, you will want to go under Remediation and click Add.  Select "Set a registry value..."

Key: HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server
Name: DisabledByDefault
Type: REG_DWORD
Data: 1

As with the Verify, you need to repeat this process for all the below:

Key: HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server
Name: Enabled
Type: REG_DWORD
Data: 0

Key: HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Client
Name: DisabledByDefault
Type: REG_DWORD
Data: 1

Key: HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Client
Name: Enabled
Type: REG_DWORD
Data: 0

You can save the task or elect to "Run Now."