Fix ERROR_IPSEC_MM_POLICY_PENDING_ELETION (0X000032DD)

I know this error is infuriating. You're trying to change a firewall rule or disconnect a VPN, and Windows throws ERROR_IPSEC_MM_POLICY_PENDING_ELETION (0x000032DD) in your face. This tripped me up the first time too. The good news? It's almost always a stuck policy that just needs a nudge.

This error happens when Windows or a group policy tried to delete an IPsec main mode policy but couldn't finish the job. Common triggers: switching from a VPN to DirectAccess, removing a third-party firewall, or a failed Windows update that touched IPsec settings. I've seen it on Windows 10 21H2 and Windows Server 2019/2022 after a bad security policy push.

Start with the simplest fix. If it doesn't work, move to the next. You won't need a reboot for most of these.

Fix 1: Quick Reset with netsh (30 seconds)

This is my go-to. Open Command Prompt as Administrator — right-click Start, choose "Command Prompt (Admin)" or "Windows PowerShell (Admin)".

Run this command:

netsh ipsec static delete policy name=all

This tells Windows to delete all static IPsec policies. If your error is from a stuck policy, this clears it instantly. No confirmation dialog, no warning — it just works.

After that, you might see the same error again if the policy was pushed by Group Policy. In that case, don't panic. Run this to refresh the policy store:

gpupdate /force

Wait 30 seconds. Try whatever you were doing before the error. If it's gone, you're done. If not, move on.

Fix 2: PowerShell Cleanup (5 minutes)

Sometimes the netsh command doesn't catch all pending deletions — especially on modern Windows 11 or Server 2022. The real fix here is PowerShell.

Open PowerShell as Administrator. Run this to list all IPsec main mode policies:

Get-NetIPsecMainModeRule | Format-List Name, DisplayName, Status

Look for any rule where Status says PendingDeletion. That's your culprit. Note the Name (it's a GUID — long string like {1234-...}).

Now delete that specific rule:

Remove-NetIPsecMainModeRule -Name "{paste the GUID here}" -Confirm:$false

If you want to nuke all main mode rules (safe if you don't need custom IPsec policies):

Get-NetIPsecMainModeRule | Remove-NetIPsecMainModeRule -Confirm:$false

This is more thorough than netsh. I've used it on a client's Windows 10 machine where netsh failed but PowerShell cleaned it right up.

After running, try your original action again. If the error still pops up, we need to dig deeper.

Fix 3: Registry Clean and Service Restart (15+ minutes)

This one's for the stubborn cases — when the policy is stuck in the registry itself. I've only needed this on heavily customized systems or after a failed security software uninstall.

Back up your registry first. Seriously. Open Regedit, go to File > Export, save a copy. You're about to touch a touchy area.

Navigate to:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\Machine\Software\Policies\Microsoft\Windows\IPsec\Policy\Local\

Look for any subkey that has a value named SoftPolicyBit or something similar that references a pending deletion. If you see it, delete the whole subkey. Only delete subkeys under the Local path. Don't touch anything above.

Now we need to restart the IPsec services to force a clean state:

net stop PolicyAgent
net start PolicyAgent
net stop IKEEXT
net start IKEEXT

That restarts the IPsec Policy Agent and IKE Extension services. You might get a warning about dependent services — ignore it, they'll restart too.

After that, force a GP update again:

gpupdate /force

Reboot if you want to be extra safe, but I've had this work without one. Try your action again. The error should be gone.

When Nothing Works

If you're still stuck after Fix 3, it's likely a corrupted Group Policy object on the domain side. Check your domain controller. Run rsop.msc on the affected machine to see which policies are applying. Look for any IPsec policies that have an "Enforced" or "Remove" setting that's half-baked.

In rare cases, a clean boot (disable all startup programs and non-Microsoft services) can reveal a third-party firewall that's holding a policy open. Uninstall it, reboot, reinstall.

I've seen Sophos and McAfee endpoint security cause this exact error. If you have those, check their logs.

One last trick: create a new local policy that overrides the stuck one. In netsh:

netsh ipsec static add policy name=OverridePolicy description="Temporary override"

Then assign it to a dummy rule. Sometimes the act of adding a new policy forces Windows to flush the old pending deletion. Weird, I know, but it's saved me twice.

Hope this gets you unstuck. If none of these work, drop a comment with your OS version (run winver) and any recent changes — and I'll try to help further.