| Event Id | 4292 |
| Source | Ipsec |
| Description | The IPSec driver has entered Block mode. IPSec will discard all inbound and outbound TCP/IP network traffic that is not permitted by boot-time IPSec Policy exemptions. User Action: To restore full unsecured TCP/IP connectivity, disable the IPSec services, and then restart the computer. For detailed troubleshooting information, review the events in the Security event log. |
| Event Information | "According To Microsoft:" CAUSE: A corrupted file in the policy store causes this problem. An interruption that occurs when the policy is being written to the disk may cause the corruption. RESOLUTION: To resolve this issue, delete the following registry subkey and then rebuild the policy: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\IPSec\Local To do this, follow these steps. 1. Delete the local policy registry subkey. To do this, follow these steps: a. Click Start, click Run, type regedit, and then click OK. b. In Registry Editor, locate and then click the following subkey: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local c. On the Edit menu, click Delete. d. Click Yes to confirm that you want to delete the subkey. e. Quit Registry Editor 2. Rebuild a new local policy store. To do this, follow this step:a. Click Start, click Run, type regsvr32 polstore.dll, and then click OK. |
| Reference Links | You receive an error message when you try to open the IPSec MMC policy on a Windows Server 2003-based computer |
Catch threats immediately
We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.