Event ID 4652

An IPsec main mode negotiation failed

An IPsec main mode negotiation failed.


Local Endpoint:
    Principal Name:     %1
    Network Address:    %9
    Keying Module Port: %10

Local Certificate:
    SHA Thumbprint:     %2
    Issuing CA:         %3
    Root CA:            %4

Remote Endpoint:
    Principal Name:     %5
    Network Address:    %11
    Keying Module Port: %12

Remote Certificate:
    SHA thumbprint:     %6
    Issuing CA:         %7
    Root CA:            %8

Additional Information:
    Keying Module Name:     %13
    Authentication Method:  %16
    Role:                   %18
    Impersonation State:    %19
    Main Mode Filter ID:    %20

Failure Information:
    Failure Point:      %14
    Failure Reason:     %15
    State:              %17
    Initiator Cookie:   %21
    Responder Cookie:   %22


Microsoft Documentation

Event ID - 4652



NameFieldInsertion StringOS
Local Endpoint Principal NameLocalMMPrincipalName%1Any
Local Certificate SHA ThumbprintLocalMMCertHash%2Any
Local Certificate Issuing CALocalMMIssuingCA%3Any
Local Certificate Root CALocalMMRootCA%4Any
Remote Endpoint Principal NameRemoteMMPrincipalName%5Any
Remote Certificate SHA ThumbpringRemoteMMCertHash%6Any
Remote Certificate Issuing CARemoteMMIssuingCA%7Any
Remote Certificate Root CARemoteMMRootCA%8Any
Local Endpoint Network AddressLocalAddress%9Any
Local Endpoint Keying Module PortLocalKeyModPort%10Any
Remote Endpoint Network AddressRemoteAddress%11Any
Remote Endpoint Keying Module PortRemoteKeyModPort%12Any
Keying Module NameKeyModName%13Any
Failure PointFailurePoint%14Any
Failure ReasonFailureReason%15Any
Authentication MethodMMAuthMethod%16Any
StateState%17Any
RoleRole%18Any
Impersonation StateMMImpersonationState%19Any
Main Mode Filter IDMMFilterID%20Any
Initiator CookieInitiatorCookie%21Any
Responder CookieResponderCookie%22Any


Lookup Audit Policy Configuration Settings

C:\> AuditPol.exe /get /subcategory:"IPsec Main Mode"



LEFT/RIGHT arrow keys for navigation

Back to List