AuthIP Failure 0XC000A086: What It Means & How to Fix

Quick answer: Run netsh advfirewall reset and netsh ipsec reset in an admin terminal, then reboot. That clears the stale IPsec policy and AuthIP cache causing the negotiation failure.

Why You're Seeing 0XC000A086

This error pops up when your Windows machine tries to establish an IPsec-authenticated connection (often a VPN or a direct remote access link) and AuthIP — the protocol handling that authentication — fails to negotiate with the remote host. The error code 0XC000A086 maps to STATUS_AUTHIP_FAILURE.

What's actually happening here is that AuthIP, which replaced the older IKE (Internet Key Exchange) in Windows Vista and later, expects a valid security association (SA) to exist or be created on the fly. If the local IPsec policy is corrupted, or a previous SA wasn't properly torn down, AuthIP can't talk to the remote side. This is common after a Windows update, a network driver change, or a failed VPN disconnect.

I've seen this most often on Windows 10 21H2 and Windows 11 22H2 after a system sleep/wake cycle or after switching between Wi-Fi and Ethernet.

Fix Steps

1. Open an admin Command Prompt. Hit Windows key, type cmd, right-click Command Prompt, select "Run as administrator."
2. Reset the IPsec policy. Run this command:
   

   netsh ipsec reset

   This removes any bogus Security Association entries that might be stuck.
3. Reset the Windows Firewall with Advanced Security. Run:
   

   netsh advfirewall reset

   This wipes the firewall rules — don't worry, Windows will recreate them on next boot. The reason step 3 works is that AuthIP policies live inside the firewall's connection security rules; a reset flushes them clean.
4. Reboot your machine. Not optional. The reset commands take full effect only after a restart.
5. Try your connection again. If it's a VPN, reconnect. You should see the error gone.

Alternative Fixes If the Main One Fails

1. Check for third-party firewall interference

If you have software like ZoneAlarm, Norton, or Comodo Firewall, temporarily disable or uninstall it. Those tools often hook into IPsec and AuthIP directly, and their policies can override Windows' own. I've seen Norton 360 block AuthIP silently — the error won't show in its logs, but you'll still get 0XC000A086.

2. Verify the remote host's IPsec configuration

If the remote server changed its IPsec settings (maybe an admin updated its authentication method from Kerberos to NTLM or vice versa) and your local policy still expects the old one, AuthIP fails. You can check your local connection security rule with:

netsh advfirewall consec show rule name="Your Rule Name"

Make sure the authentication method matches what the remote side expects. If you don't know, contact the admin.

3. Reset the Windows Security Association cache manually

Sometimes the netsh ipsec reset command doesn't clear everything. Run this to kill all active security associations:

powershell -Command "Get-NetIPsecMainModeSA | Remove-NetIPsecMainModeSA -Confirm:$false"

Then reboot. This is a nuclear option — it drops all active IPsec connections, but it's safe.

Prevention

The most common trigger for 0XC000A086 is a Windows Update that modifies the local policy store. Before blaming your ISP or the remote server, always check if an update ran recently. Go to Settings > Windows Update > Update history and see if there's a Security Update for Windows (KB5027231) or similar. Those updates sometimes reset the IPsec stack.

To prevent recurrence, you can export your current firewall rules once you have a working connection:

netsh advfirewall export "C:\firewall_backup.wfw"

Then after a future update that breaks AuthIP, you can import it back with netsh advfirewall import. Saves you from having to reconfigure custom rules.