Wednesday, October 13, 2010

Event ID 4292 - The IPSec driver has entered Block mode.

Full event properties:
The IPSec driver has entered Block mode. IPSec will discard all inbound and outbound TCP/IP network traffic that is not permitted by boot-time IPSec Policy exemptions. User Action: To restore full unsecured TCP/IP connectivity, disable the IPSec services, and then restart the computer. For detailed troubleshooting information, review the events in the Security event log.

Possible Cause:
A corrupted file in the policy store causes this problem. An interruption that occurs when the policy is being written to the disk may cause the corruption.

Check:
When you try to open the Internet Protocol security (IPSec) Microsoft Management Console (MMC) policy on a Microsoft Windows Server 2003-based computer, you receive the following error message:

"The IPSec Policy storage container could not be opened. The following error occurred: The system cannot find the file specified. (80070002)."

Resolution:
  1. In Registry Editor, locate and then DELETE the following subkey: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local
  2. Close Registry Editor.
  3. Rebuild a new local policy store. To do this, Click Start, click Run, type regsvr32 polstore.dll, and then click OK.

References: http://support.microsoft.com/kb/870910

No comments:

Post a Comment