Fix ERROR_IPSEC_DEFAULT_MM_POLICY_NOT_FOUND 0X000032D5

That 0X000032D5 error is frustrating, I know. You're setting up a VPN or a firewall rule, and Windows just says "nope, policy not found." Let's fix it fast.

The Direct Fix

This works on Windows 10 (all versions) and Windows Server 2016 through 2022. Open Command Prompt as Administrator — right-click Start, choose "Command Prompt (Admin)" or "Windows PowerShell (Admin)."

Run this command:

netsh ipsec static set policy name="DefaultResponse"

After hitting Enter, you should see: "Command completed successfully." No extra message, just a clean return.

But wait — that only works if the policy actually exists but isn't set as default. If it doesn't exist at all (common after a registry cleanup or group policy reset), do this instead:

1. Open Command Prompt as Admin.
2. Run regsvr32 polstore.dll — this re-registers the IPsec policy store. You'll see a popup saying "DllRegisterServer in polstore.dll succeeded."
3. Then run net start ipsecsvc to restart the IPsec service. It might already be running — that's fine, just restart it.
4. Now run netsh ipsec static set policy name="DefaultResponse"

Still no luck? The default policy might be corrupted. Delete and recreate it:

netsh ipsec static delete policy name="DefaultResponse"
netsh ipsec static add policy name="DefaultResponse" description="Default response policy"
netsh ipsec static set policy name="DefaultResponse"

You'll see confirmation after each step. The last command should succeed cleanly.

Why This Happens

The real trigger is often a Group Policy update that went wrong. For example, you join a domain, the domain controller pushes an IPsec policy, and then the policy gets orphaned when the computer leaves the domain. Or you uninstall a VPN client that messed with the IPsec store. I've also seen this after a Windows Update (specifically KB5009543 on Windows 10 21H2) that resets security policies.

Windows stores IPsec policies in the registry under HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local. If that key or its subkeys are missing or have bad ACLs, you get 0X000032D5. The regsvr32 command re-registers the COM component that reads that key, and the netsh commands rebuild the default policy data.

Less Common Variations

Sometimes you're dealing with a remote computer or a server cluster. In that case, you might need to specify the remote machine:

netsh ipsec static set machine=RemoteComputerName policy name="DefaultResponse"

Replace RemoteComputerName with the actual name. Run this from your admin computer with appropriate permissions.

Another variation: the error appears only when using the Windows Firewall with Advanced Security MMC snap-in. The snap-in tries to load IPsec policies and throws 0X000032D5. The fix is the same — run the netsh commands on the machine, then close and reopen the MMC.

If you're running a script or application that calls IPsecSetDefaultPolicy API directly, the error means the policy name passed in doesn't exist. Check your code: you might have a typo in the policy name string.

Prevention

Don't mess with the IPsec registry keys manually — ever. I've seen admins delete them thinking they're cleaning up junk. That's the fastest way to break this. If you need to reset IPsec, use netsh or the Windows Firewall MMC, not regedit.

Back up your IPsec policies before any major Windows Update or domain migration. Run this:

netsh ipsec static export store="C:\backup\ipsec-policies.xml"

This exports all local policies to an XML file. If things go sideways after an update, import it back with netsh ipsec static import.

Also, avoid third-party VPN software that installs its own IPsec drivers. Some of them orphan policies on uninstall. Stick with built-in Windows VPN or well-known clients like Cisco AnyConnect that clean up after themselves.