Fix IPSec IKE Add Update Key Failed 0X00003624

Quick Answer

Run net stop ipsec then net start ipsec in an admin command prompt. If that doesn't work, clear the IPsec policy store with netsh ipsec static delete all.

Why This Happens

I've seen this error a lot when people switch VPN clients or update their network drivers. The IPSec driver gets confused about what security associations (SAs) it's supposed to remember. It's like it has too many sticky notes and can't find the right one.

This error pops up most often on Windows 10 version 22H2 and Windows 11 version 23H2, especially after installing a VPN client like Cisco AnyConnect or OpenVPN, then trying to use the built-in Windows VPN. The driver holds onto old SAs from the previous client, and when the new connection tries to add a new SA, the driver says "nope, I'm full" or "that doesn't match what I have."

The exact error code is 0X00003624, which translates to ERROR_IPSEC_IKE_ADD_UPDATE_KEY_FAILED. It means the IKE (Internet Key Exchange) protocol tried to add or update a key in the IPSec driver, but the driver rejected it. This isn't a hardware failure—it's a software configuration mess.

I know this error is infuriating because it breaks your VPN and you have no idea why. But trust me, the fix is usually straightforward.

Main Fix: Restart the IPsec Service

This clears the driver's memory of old SAs. Do it in order:

1. Open Command Prompt as administrator (right-click Start, choose Command Prompt (Admin) or Terminal (Admin)).
2. Type net stop ipsec and press Enter. Wait for it to stop. You'll see a message saying "The IPsec Services service was stopped successfully."
3. Then type net start ipsec and press Enter. Wait for it to start. You should see "The IPsec Services service was started successfully."
4. Now try your VPN connection again. The error should be gone.

This works about 80% of the time. The driver gets a clean slate and accepts the new SA.

Alternative Fix 1: Clear the IPsec Policy Store

If restarting the service didn't help, the policy store is corrupt. This command wipes all IPsec policies and rules:

netsh ipsec static delete all

Run that in an admin command prompt. It deletes everything—your custom firewall rules, your VPN policies, everything. So only do this if you're okay rebuilding those later. After running it, restart your computer.

Then recreate your VPN connection or reinstall your VPN client. This should fix the error because the driver now has no old junk to trip over.

Alternative Fix 2: Reset Winsock and IP Stack

Sometimes the network stack itself is broken. I've seen this fix work after a botched VPN client uninstall:

1. Open admin command prompt.
2. Run netsh winsock reset and press Enter. Restart your PC when prompted.
3. After restart, run netsh int ip reset and press Enter. Restart again.

This resets Winsock (the Windows Sockets API) and the IP stack back to defaults. It usually fixes weird IPSec errors when nothing else does.

Alternative Fix 3: Check for VPN Client Conflicts

If you have two VPN clients installed (like Cisco AnyConnect and OpenVPN, or an old one you forgot about), they can clash. Uninstall all VPN clients except the one you need. Then restart and try again.

I once had a user with three VPN clients on their machine—total mess. After removing two, the error vanished.

Prevention Tip

To avoid this error in the future, always uninstall your old VPN client completely before installing a new one. Use the uninstaller from the vendor, then restart, then install the new one. Don't just leave the old one sitting there—its IPSec policies stick around and cause exactly this problem.

Bottom line: this error is almost always about a dirty IPSec driver state, not a hardware issue. A service restart or policy wipe will fix it 95% of the time.