Fix ERROR_IPSEC_IKE_SHUTTING_DOWN (0X00003643)

What's happening here

You're trying to connect to a VPN, and right at the moment the tunnel should establish, you get ERROR_IPSEC_IKE_SHUTTING_DOWN (0X00003643). The message says the IKE service is shutting down. That's Windows telling you the IPsec Keying Modules service (PolicyAgent) died or is in the middle of stopping. This isn't a network problem — it's a local service problem. I've seen this on Windows 10 and Server 2019/2022 machines after a crash, a bad policy push, or a pending restart.

You'll most often see this on a laptop that just resumed from sleep, or on a server after a group policy update that touched IPsec settings. Sometimes it follows a blue screen or a forced shutdown.

Work down this list. Stop when the error goes away.

Fix 1: Restart the IPsec service (30 seconds)

This is the quickest shot. The IKE service might just be stuck in a stopping state. You'll need admin rights.

Press Win + R, type services.msc, and hit Enter.
Scroll down to IKE and AuthIP IPsec Keying Modules. Look at its status. It'll probably say Stopped or Stopping.
Right-click it and choose Start. If it's already running, choose Restart.
Wait 10 seconds, then try your VPN connection again.

What you should see: the service status flips to Running and stays there. If it immediately goes back to Stopped, don't bother repeating this — move to the next fix.

If restarting the service fixed it, you're done. But if you want to prevent it from happening again, jump to Fix 3 and check for corrupt policies, because a restart only patches the symptom.

Fix 2: Clear the IPsec policy cache (5 minutes)

Sometimes the service starts fine but dies when it loads a corrupt or half-applied IPsec policy. This usually happens after a group policy update or a failed VPN configuration. You'll clear the cached policy and let Windows rebuild it.

Open an elevated Command Prompt (right-click Command Prompt, run as administrator).
Run these two commands, one at a time:

netsh ipsec static reset

That resets the static IPsec configuration. It deletes any custom IPsec policies you've created locally, but it doesn't touch the Windows Firewall rules. Don't worry — your VPN client will recreate what it needs.

ipconfig /flushdns

Not strictly necessary, but flushes DNS in case a stale entry is pointing your VPN to a dead server.

Restart the IKE service again (same steps as Fix 1).
Try your VPN.

After the reset, you should see the service stay running for at least a minute. If it still crashes right when you connect, the problem is deeper — go to Fix 3.

Fix 3: Check the event log and repair the service (15+ minutes)

This is where you find the root cause. The service is crashing for a reason, and the event log will tell you what it is. Don't skip this — it's the difference between a temporary fix and a permanent one.

Open Event Viewer (Win + R, type eventvwr.msc).
Go to Windows Logs > System.
Look for events with Source PolicyAgent or IKEEXT that happened right around the time of the error. Filter by the time you saw the error.

You'll likely see one of these:

Event ID 4650 — an IPsec policy was modified, and then the service crashed. That points to a policy issue.
Event ID 8003 — the IKE service encountered an error and terminated. Often accompanied by a 0x8007271c or similar socket error.
If you see a Service Control Manager event (Source: Service Control Manager) saying the service terminated unexpectedly, that's a crash, not a policy problem.

Based on what you find, do one of the following:

If it's a policy issue:

Open an elevated Command Prompt.
Run gpupdate /force to pull down fresh policy.
Then run netsh ipsec static delete all to remove any stale local policies.
Restart the service.

If it's a crash (Terminated Unexpectedly):

This points to a corrupt service binary or a conflict with another security product. Try this:

Open an elevated Command Prompt.
Run sfc /scannow and let it finish. It checks system files and repairs what's broken. Expect this to take 10-15 minutes.
After that, run DISM /Online /Cleanup-Image /RestoreHealth — this fixes the Windows image itself. Again, give it time.
Restart your machine.

After the restart, check the service status. It should be running. Try your VPN.

If DISM and SFC don't find anything, and the service still crashes, you're dealing with a third-party firewall or VPN client that's hooking into the IKE service. Uninstall any third-party security software temporarily, restart, and test. If the error vanishes, that's your culprit.

One real scenario: a user on a Dell Latitude running Windows 10 got this error every time they connected to their office VPN. Event log showed Event ID 8003, and the culprit was a stale Cisco AnyConnect client that had been uninstalled but left behind a filter driver. Removing that driver fixed it.

When to stop and call in help

If you've gone through all three fixes and the service still dies, the issue might be in the registry. Specifically, check this key:

HKLM\SYSTEM\CurrentControlSet\Services\PolicyAgent

Look at the Start value. It should be 2 (automatic). If it's anything else, set it to 2 and restart. But honestly, if you're at this point, you're better off getting someone who knows IPsec deeply — this could be a driver-level conflict that needs a network trace.

Also, if you're on a server that's part of a cluster, check that the IPsec service is set to Manual on the passive nodes. That's a known gotcha.

Remember: the error code tells you the service is stopping, not that the network is down. Keep your focus local.