diff --git a/setup-windows.ps1 b/setup-windows.ps1
index eed50ec..800e135 100644
--- a/setup-windows.ps1
+++ b/setup-windows.ps1
@@ -1,5 +1,8 @@
-# TLS 1.2 erzwingen (Windows Server 2016 / aeltere Systeme)
-[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
+# TLS 1.2 + alle Varianten aktivieren (Windows Server 2016 Kompatibilitaet)
+[Net.ServicePointManager]::SecurityProtocol = `
+    [Net.SecurityProtocolType]::Tls12 -bor `
+    [Net.SecurityProtocolType]::Tls11 -bor `
+    [Net.SecurityProtocolType]::Tls
 
 # Adminrechte pruefen und ggf. neu starten
 $isAdmin = ([Security.Principal.WindowsPrincipal] `
@@ -28,14 +31,12 @@ if ($policy -in @('Bypass', 'Unrestricted', 'RemoteSigned')) {
         Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope CurrentUser -Force
         Write-Host "      OK"
     } catch {
-        # GPO ueberschreibt - wenn aktuelle Policy ausfuehrbar ist, weitermachen
         $effective = Get-ExecutionPolicy
         if ($effective -in @('Bypass', 'Unrestricted', 'RemoteSigned')) {
-            Write-Host "      GPO-Ueberschreibung - aktuelle Policy '$effective' ist ausreichend"
+            Write-Host "      GPO-Override - aktuelle Policy '$effective' ist ausreichend"
         } else {
             Write-Host "FEHLER: Execution Policy '$effective' blockiert Ausfuehrung."
-            Read-Host "Enter zum Beenden"
-            exit 1
+            Read-Host "Enter zum Beenden"; exit 1
         }
     }
 }
@@ -47,7 +48,32 @@ $scoopInstalled = (Test-Path "$scoopShims\scoop.ps1") -or (Test-Path "$scoopShim
 
 if (-not $scoopInstalled) {
     Write-Host "      Scoop nicht gefunden - wird installiert..."
-    Invoke-RestMethod -Uri https://get.scoop.sh | Invoke-Expression
+
+    $installed = $false
+    # Versuch 1: Invoke-RestMethod
+    try {
+        Invoke-RestMethod -Uri https://get.scoop.sh | Invoke-Expression
+        $installed = $true
+    } catch {
+        Write-Host "      Invoke-RestMethod fehlgeschlagen ($_), versuche WebClient..."
+    }
+    # Versuch 2: WebClient (anderer TLS-Stack)
+    if (-not $installed) {
+        try {
+            (New-Object System.Net.WebClient).DownloadString('https://get.scoop.sh') | Invoke-Expression
+            $installed = $true
+        } catch {
+            Write-Host "FEHLER: Scoop-Download fehlgeschlagen: $_"
+            Write-Host "Netzwerk oder SSL/TLS pruefen."
+            Read-Host "Enter zum Beenden"; exit 1
+        }
+    }
+
+    # Pruefen ob Scoop wirklich da ist
+    if (-not ((Test-Path "$scoopShims\scoop.ps1") -or (Test-Path "$scoopShims\scoop.cmd"))) {
+        Write-Host "FEHLER: Scoop-Installation fehlgeschlagen (Verzeichnis fehlt)."
+        Read-Host "Enter zum Beenden"; exit 1
+    }
     Write-Host "      Scoop installiert."
 } else {
     Write-Host "      Scoop bereits vorhanden."
@@ -69,17 +95,28 @@ try {
 
 if (-not $7zipOk) {
     Write-Host "      7zip fehlgeschlagen - bereinige und versuche erneut..."
-    scoop uninstall 7zip 2>$null
-    scoop cache rm 7zip 2>$null
-    Remove-Item -Recurse -Force "$env:USERPROFILE\scoopppszip" -ErrorAction SilentlyContinue
-    scoop install 7zip
+    try { scoop uninstall 7zip } catch {}
+    try { scoop cache rm 7zip } catch {}
+    Remove-Item -Recurse -Force "$env:USERPROFILE\scoop\apps\7zip" -ErrorAction SilentlyContinue
+    try {
+        scoop install 7zip
+        $7zipOk = $true
+    } catch {
+        Write-Host "FEHLER: 7zip konnte nicht installiert werden: $_"
+        Read-Host "Enter zum Beenden"; exit 1
+    }
 }
 Write-Host "      OK"
 
 # 4. upterm
 Write-Host "[4/4] Installiere upterm..."
-scoop bucket add upterm https://github.com/owenthereal/scoop-upterm 2>&1 | Out-Null
-scoop install upterm
+try { scoop bucket add upterm https://github.com/owenthereal/scoop-upterm } catch {}
+try {
+    scoop install upterm
+} catch {
+    Write-Host "FEHLER: upterm Installation fehlgeschlagen: $_"
+    Read-Host "Enter zum Beenden"; exit 1
+}
 Write-Host "      OK"
 
 Write-Host ""