Fix ERROR_IPSEC_MM_AUTH_IN_USE (0X000032D4) – Quick Steps

1. Duplicate or Stale Main Mode Rules

The culprit here is almost always duplicate main mode rules. When you import or apply IPsec policies via Group Policy or netsh, you can accidentally add the same authentication list twice. Windows sees the list as “in use” because two rules reference it, even if one is stale.

To check, open an elevated command prompt (Run as Administrator) and run:

netsh ipsec static show mmfilter

Look for duplicate lines with the same MMAuthList name. If you see extras, remove them:

netsh ipsec static delete mmfilter name="YourRuleName"

Replace YourRuleName with the exact duplicate. Then restart the IPsec service:

net stop policyagent
net start policyagent

Try your operation again. This solves about 80% of cases I've seen on Windows Server 2016/2019 and Windows 10 Pro.

2. Another Service Holding the Lock

If deleting duplicates didn't work, the auth list might be locked by a service besides Policy Agent. The usual suspects are Routing and Remote Access (RRAS) or Windows Firewall with Advanced Security. When RRAS sets up a VPN connection using IKE, it grabs the main mode list and won't let go if the connection fails to tear down.

Check if RRAS is running:

sc query remoteaccess | find "STATE"

If it shows RUNNING, stop it temporarily:

net stop remoteaccess

Then flush IPsec:

netsh ipsec static reset

Restart both services:

net start policyagent
net start remoteaccess

Important: resetting IPsec wipes all custom rules. Back them up first with netsh ipsec static export "backup.ipsec" if you have complex policies.

3. Corrupt IPsec Policy Store

In rare cases, the local IPsec policy database (%systemroot%\system32\secpol.msc store) gets corrupted after a bad Group Policy update or an interrupted import. This doesn't happen often, but when it does, the error sticks around even after deleting every rule.

The fix: delete the store and let Windows rebuild it. Stop the Policy Agent service first:

net stop policyagent

Then delete the store file:

del /f /q "%systemroot%\system32\secpol.sdb"

Restart the service:

net start policyagent

Windows creates a fresh secpol.sdb automatically. Reapply your IPsec policies from scratch or via GPO. This is a last resort—don't do it unless you're sure the policy store is hosed. You can verify corruption by checking the Application event log for event ID 5447 from IPsec.

Quick-Reference Table