Tuesday, August 20, 2013

Event ID: 4292 The IPSec driver has entered Block mode. - Server initially pingable during startup, then stops

This morning I had a VM which was inaccessible over the network.  The VM was "up" and I was able to log into the server locally using the console.  IP settings were good, I confirmed that the network settings on the VMware side were good, and I did the ol' disconnect/reconnect of the vNIC.  No Go.

One interesting thing,  upon reboot, I would receive ping replies, then they would abruptly stop:

The Event logs had the following:

Event ID: 4292 The IPSec driver has entered Block mode


Apparently, the IPsec service on the server 'lost its mind" and placed the NIC in a blocked state.  The resolution according to Microsoft KB 912023 is as follows:

To resolve this issue, follow these steps:
  1. Delete the local policy registry subkey. To do this, follow these steps:
    1. Click Start, click Run, type regedit in the Open box, and then click OK.
    2. In Registry Editor, locate and then click the following subkey:
      HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local
    3. On the Edit menu, click Delete.
    4. Click Yes to confirm that you want to delete the subkey.
    5. Quit Registry Editor
  2. Rebuild a new local policy store. To do this, Click Start, click Run, type regsvr32 polstore.dll in the Open box, and then click OK.
  3. Verify that the IPSEC Services component is set to automatic, and then restart the domain controller.
In my case, the registry did not have the \IPSec\ Key...  So, I ended up just running following command and restarting the server:

regsvr32 polstore.dll

I bounced the server several times to confirm that the server came up clean and the issue had been resolved.

1 comment:

  1. thanks! I was trying to figure this out since yesterday...

    ReplyDelete