Fix 0X000035F4: IPsec IKE Queue Drop No MM Error

You're not alone—this error is a pain

I know this error is infuriating. You try to connect to a VPN or set up a secure tunnel, and bam—0X000035F4 pops up, telling you the negotiation request sat in the queue too long. It's especially common on Windows 10 and Server 2016 after a reboot or when a VPN client crashes. Let's fix it.

The quick fix: restart the IKE service and flush the queue

Most of the time, the IKE (Internet Key Exchange) service just needs a kick. But a simple restart isn't enough—you need to flush the Main Mode (MM) queue. Here's what works:

1. Open Command Prompt as Admin. Press Win + X, then click 'Command Prompt (Admin)' or 'Terminal (Admin)'.
2. Type net stop IKEEXT and hit Enter. That stops the IKE and AuthIP Keying Modules service.
3. Then type net start IKEEXT to start it again.
4. Now run netsh advfirewall reset to reset the firewall policy—this clears any stuck IPsec rules.
5. Finally, type ipsec reset to flush the IKE queue. Wait 10 seconds, then try your VPN again.

This works about 80% of the time. If it doesn't, move to the next fix.

Why this works

The error 0X000035F4 means a Main Mode negotiation request was dropped because the queue was full. Think of it like a busy diner—the waiter can't take your order because they're stuck with a table that never pays the bill. Restarting the service empties that table. The netsh advfirewall reset cleans up any orphaned security associations that keep the queue clogged. The ipsec reset command forces all pending negotiations to cancel. Without this, you're just waiting for the timeout, which can be 5 minutes or more.

Less common variations: registry tweak for persistent cases

Sometimes the error comes back after a few hours. On Windows Server 2019, I've seen this when the MaxPendingNegotiations registry key is set too low. The default is 100, but if your server handles many VPN connections, you need to raise it.

1. Open Regedit as Admin.
2. Go to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PolicyAgent\Parameters
3. Right-click, choose New > DWORD (32-bit), name it MaxPendingNegotiations.
4. Set its value to 200 or 300 (decimal). Don't go above 500—it can slow your computer.
5. Restart the service again with net stop IKEEXT and net start IKEEXT.

This is for advanced users. If you don't know what you're doing, skip it. The first fix is usually enough.

Another variation: check your VPN client version

On Windows 11, I've seen this error after a Windows Update. If you're using a third-party VPN like Cisco AnyConnect or Pulse Secure, make sure it's updated. Old clients can send bad security associations that fill the queue. Uninstall the client, reboot, then install the latest version from your IT department. This alone fixed the error for a colleague who used Cisco AnyConnect 4.8 on Windows 11.

Prevention: stop it from coming back

To avoid this error, don't just close your VPN—disconnect properly. When you shut down your computer with a VPN still connected, the IKE queue can get stuck. Also, if you're an admin managing multiple VPN users, set a shorter timeout for pending negotiations. In the registry key above, add another DWORD called NegotiationTimeoutMin and set it to 1 (decimal). This drops stuck negotiations after 1 minute instead of 5. But test this first—some servers need more time for complex authentication.

One last thing: check your firewall logs. If you see many 0X000035F4 errors, it might be a network problem, not a software one. A misconfigured router or a firewall that blocks UDP port 500 (IKE) can cause this. Run netsh wfp show state to see if any filters are dropping IKE packets. That's a deeper issue, but it's rare.

Hope this gets you back online. Let me know if it worked.