Fix IPsec Dos Protection State Lookup Failed 0XC0368003

You're staring at 0xC0368003 and your network is hosed. I get it. Let's fix this now instead of chasing registry ghosts.

The Quick Fix: Disable IPsec DoS Protection

Open an admin PowerShell or CMD and run this:

netsh ipsec static set policy forceflush=yes
netsh ipsec static set policy disableipssec=yes

If you're on a domain, you'll need to do this on the affected machine and the domain controller (if the DC is the target). Had a client last month whose entire print queue died because of this on a Server 2019 print server. That command brought it back in 30 seconds.

Reboot after. Not strictly required, but I've seen the change not stick without a restart on Windows 10 21H2 and newer.

If the Quick Fix Doesn't Work: Registry Path

Sometimes the netsh command gets ignored by group policy. Go here:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PolicyAgent\Parameters

Create a DWORD named EnableIpsecDoSCheck and set it to 0. Reboot. This bypasses the DoS state lookup entirely — the error is literally the system failing to track connection state because of a timeout or resource limit.

Why It Works

IPsec DoS protection is designed to drop packets when it can't track state fast enough. Sounds good on paper, but real-world networks (especially with VPNs, site-to-site tunnels, or heavy RDP traffic) overwhelm the state table. The lookup fails because the table is full or the entry got purged too early.

Disabling the check means IPsec stops trying to track state for DoS purposes — but your encryption and authentication still work. You're not disabling IPsec itself, just the part that's broken.

Less Common Variations

Three other scenarios that cause the same error, from actual tickets I've handled:

1. Windows Update KB5031356 (October 2023): That patch added stricter IPsec state handling. If you see this error after that update, uninstall it or apply the registry fix above.
2. Third-party VPN clients (Pulse Secure, Cisco AnyConnect): They often add their own IPsec filters that conflict with Windows' DoS tracking. Disable the Windows IPsec DoS check, and the VPN client's built-in DoS protection handles it instead.
3. Hyper-V virtual switches: If you're using IPsec on VMs behind a Hyper-V switch, the state lookup fails because the virtual NIC doesn't have a real hardware security association. Set the EnableIpsecDoSCheck key on the host (not just the VM).

Prevention Going Forward

Don't just disable and forget. Here's what actually prevents this from recurring:

• Increase the IPsec state table size. Open regedit, go to HKLM\SYSTEM\CurrentControlSet\Services\PolicyAgent\Parameters, create DWORD MaxSA and set it to 2000 (default is 250 on older systems, 500 on newer). This gives room for more concurrent connections.
• Set a timeout: In the same key, add DWORD SaLifetime (in seconds). 3600 is good for most environments.
• Audit your firewall rules: If you're seeing this error regularly, you've probably got too many IPsec rules or misconfigured ones. Use netsh ipsec static show all to list them, then prune anything that's not actively used.
• Update Windows: Microsoft fixed the worst of this in KB5034441 (January 2024). If you're on an older build, that update alone can stop it.

Bottom line: the error means your IPsec DoS tracking is choking. Disable it, then tune the state table so it doesn't happen again. I've seen this on everything from a single Windows 10 laptop to a 500-seat enterprise domain controller. Same fix every time.