mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-19 00:37:22 +00:00
50 lines
2.6 KiB
Markdown
50 lines
2.6 KiB
Markdown
---
|
|
title: Audit IPsec Main Mode (Windows 10)
|
|
description: Learn about the policy setting, Audit IPsec Main Mode, which determines if the results of certain protocols generate events during Main Mode negotiations.
|
|
ms.assetid: 06ed26ec-3620-4ef4-a47a-c70df9c8827b
|
|
ms.reviewer:
|
|
manager: dansimp
|
|
ms.author: dansimp
|
|
ms.pagetype: security
|
|
ms.prod: w10
|
|
ms.mktglfcycl: deploy
|
|
ms.sitesec: library
|
|
ms.localizationpriority: none
|
|
author: dansimp
|
|
ms.date: 10/02/2018
|
|
---
|
|
|
|
# Audit IPsec Main Mode
|
|
|
|
**Applies to**
|
|
- Windows 10
|
|
- Windows Server 2016
|
|
|
|
Audit IPsec Main Mode allows you to audit events generated by Internet Key Exchange protocol (IKE) and Authenticated Internet Protocol (AuthIP) during Main Mode negotiations.
|
|
|
|
Audit IPsec Main Mode subcategory is out of scope of this document, because this subcategory is mainly used for IPsec Main Mode troubleshooting.
|
|
|
|
| Computer Type | General Success | General Failure | Stronger Success | Stronger Failure | Comments |
|
|
|-------------------|-----------------|-----------------|------------------|------------------|----------|
|
|
| Domain Controller | IF | IF | IF | IF | IF - This subcategory is mainly used for IPsec Main Mode troubleshooting, or for tracing or monitoring IPsec Main Mode operations. |
|
|
| Member Server | IF | IF | IF | IF | IF - This subcategory is mainly used for IPsec Main Mode troubleshooting, or for tracing or monitoring IPsec Main Mode operations. |
|
|
| Workstation | IF | IF | IF | IF | IF - This subcategory is mainly used for IPsec Main Mode troubleshooting, or for tracing or monitoring IPsec Main Mode operations. |
|
|
|
|
- 4646(S): Security ID: %1
|
|
|
|
- 4650(S): An IPsec Main Mode security association was established. Extended Mode was not enabled. Certificate authentication was not used.
|
|
|
|
- 4651(S): An IPsec Main Mode security association was established. Extended Mode was not enabled. A certificate was used for authentication.
|
|
|
|
- 4652(F): An IPsec Main Mode negotiation failed.
|
|
|
|
- 4653(F): An IPsec Main Mode negotiation failed.
|
|
|
|
- 4655(S): An IPsec Main Mode security association ended.
|
|
|
|
- 4976(S): During Main Mode negotiation, IPsec received an invalid negotiation packet. If this problem persists, it could indicate a network issue or an attempt to modify or replay this negotiation.
|
|
|
|
- 5049(S): An IPsec Security Association was deleted.
|
|
|
|
- 5453(S): An IPsec negotiation with a remote computer failed because the IKE and AuthIP IPsec Keying Modules (IKEEXT) service is not started.
|