Is there a resolution to nmap ssl-enum-ciphers not returning all TLS 1.2 cipher suites?

Microsoft lists 36 cipher suites available to TLS 1.2 protocol enabled in a vanilla installation of Windows Server 2016 Build 1607:

excludes 2 cipher suites available only used when an application explicitly requests
source: https://learn.microsoft.com/en-us/windows/win32/secauthn/tls-cipher-suites-in-windows-10-v1607

Accounting for enabled=false Ciphers and KeyExchangeAlgorithms (registry HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL), and verifying that Cipher Suite Order and Elliptic Curve Order is default (gpedit.msc), the list of enabled cipher suites is reduced to 32.

Why does nmap 7.9.1 return only 10 cipher suites?

nmap --script ssl-enum-ciphers -p3389 TestServerName.domain.tld

results
4 x TLS_DHE_RSA_WITH_AES_*, and
6 x TLS_ECDHE_RSA_WITH_AES_*

The most recent update on nmap.org thread "ssl-enum-ciphers not returning all ciphers" is July 23, 2019: https://seclists.org/nmap-dev/2019/q3/4

Has anyone resolved this issue?

PS There is a difference of TLS version in a single network trace frame (shown below) and I'm not certain if this is part of the issue or unrelated.

Solution

I have learned that the the ordered set of Cipher Suites that are Enabled on a Windows device is defined in the value data from the Functions value located in the Registry at:

HKLM\SOFTWARE\Policies\Microsoft\Cryptography\Configuration\SSL\00010002

This can be populated during creation of the Group Policy Object, or locally using Group Policy Editor (i.e. choosing "Enabled" and editing the list and/or order of cipher suites).

If Functions value is absent, then the ordered set of Enabled cipher suites are default for the Edition and Build of Windows: https://learn.microsoft.com/en-us/windows/win32/secauthn/cipher-suites-in-schannel