win:security 5453
An IPsec negotiation with a remote computer failed because the IKE and AuthIP IPsec Keying Modules (IKEEXT) service is not started.
- Log source
- Windows Security event log
- Host type
- Windows (workstation, member server, domain controller)
- How to enable
- Advanced Audit Policy: Logon/Logoff > Audit IPsec Main Mode
- Audit category
- Logon/Logoff
- Audit subcategory
- Audit IPsec Main Mode
- Tier, host type
- Recommended
- Techniques
- 0
- Rules depending on it
- none
Why this tier
Microsoft Appendix L Medium
By role
| Role | Tier | Basis |
|---|---|---|
| Windows workstation | Recommended | Microsoft Appendix L Medium |
| Windows member server | Recommended | Microsoft Appendix L Medium |
| Windows domain controller | Recommended | Microsoft Appendix L Medium |
| Windows web server (IIS), internet-facing | Recommended | Microsoft Appendix L Medium |
Techniques it helps detect
No ATT&CK analytic names this event. Its standing comes from the standards and rules below.
Rules that depend on it
No vendor rule names this event or source directly.
Standards and guidance naming it
| Requirement | Relation | Basis |
|---|---|---|
| Microsoft: Events to monitor with potential criticalityAppendix L: Events to Monitor (Windows Server AD DS best practices) | Names this event | potential criticality Medium: An IPsec negotiation with a remote computer failed because the IKE and AuthIP IPsec Keying Modules (IKEEXT) service is not started. |