Event ID 4963
IPsec dropped an inbound clear text packet that should have been securedIPsec dropped an inbound clear text packet that should have been secured. If the remote computer is configured with a Request Outbound IPsec policy, this might be benign and expected. This can also be caused by the remote computer changing its IPsec policy without informing this computer. This could also be a spoofing attack attempt. Remote Network Address: %1 Inbound SA SPI: %2
Auditing:
Conditional
Volume:
Low
Lookup Audit Policy Configuration Settings
C:\> AuditPol.exe /get /subcategory:"IPsec Driver"
LEFT/RIGHT arrow keys for navigation
Back to List