Getting this error is a pain, especially when you're just trying to connect to your office VPN or a secure remote server. The good news: it's usually a quick fix that doesn't require a full system rebuild. Let's get right to it.
The Fix: Reset IPsec Policy and Re-register Security Associations
This error typically appears when Windows has a stale or misconfigured IPsec policy that conflicts with the keying module (KeyMod) being used. The fix is to clear the old policy and let Windows rebuild it. You'll need admin rights for this.
- Press Windows Key + X and select Windows Terminal (Admin) or Command Prompt (Admin).
- In the command window, type the following and press Enter after each line:
netsh ipsec static delete policy name=all
netsh ipsec dynamic delete all
ipconfig /flushdnsAfter running the first command, you'll see a message like "Policy deletion completed successfully." The second command clears all dynamic security associations — it might take a few seconds, and you'll see no output, which is normal. The third command flushes DNS, which isn't strictly necessary but helps for some VPN setups.
- Now restart the IPsec services. Run these commands:
net stop PolicyAgent && net start PolicyAgent
net stop IKEEXT && net start IKEEXTYou'll see "The service is stopping" and then "The service is starting" messages. Wait a couple of seconds between the stop and start.
- Try your VPN or IPsec connection again. In most cases, it works right after this.
If you still get the error, reboot the machine and test again. That clears any leftover kernel state.
Why This Works
The error 0XC0368005 translates to "KEYMOD_NOT_ALLOWED" — Windows is telling you that the keying module (IKE or AuthIP) you're using isn't allowed by the current IPsec policy. That happens when a policy was created for a different keying module, or the policy got corrupted after a Windows update or a third-party security tool changed settings.
Deleting the static and dynamic policies forces Windows to rebuild them from scratch. The restart of PolicyAgent (which handles IPsec) and IKEEXT (which handles IKE and AuthIP) ensures that the new policy is loaded cleanly. This is the same trick I've used on dozens of machines since Windows 7, and it still works on Windows 10 and 11.
Less Common Variations
Variation 1: The Error Appears in Event Viewer Only
Sometimes you won't see a pop-up, but you'll find this error logged in Event Viewer under Windows Logs > System with source IPsec or PolicyAgent. The fix is the same as above. But if the error logs after every boot, you might have a startup script or Group Policy that creates a conflicting policy. Check Group Policy with gpresult /h gp.html and look for any IPsec assignments.
Variation 2: The Error Appears in a Specific Application Only
If a specific app (like a custom VPN client) triggers it, the app might be setting its own IPsec policy. In that case, check the app's documentation for a "reset policy" option. Or you can use netsh ipsec static show policy all to see what policies exist. If you see a policy named after the app, delete it with netsh ipsec static delete policy name="appname" — but be careful, because that might break the app's functionality.
Variation 3: The Error Comes from a Domain Machine
If your PC is joined to a domain, the error might be caused by a Group Policy that enforces specific IPsec settings. You can't just delete those policies locally. Instead, run gpupdate /force to refresh them. If that doesn't help, contact your network admin — they'll need to adjust the policy in the Group Policy Management Console.
Prevention
Once you've fixed the error, you don't want it coming back. Here's what I've seen cause this in the real world:
- Third-party security tools like some antivirus or firewall suites that mess with IPsec. If you installed one recently, consider replacing it with a more VPN-friendly option.
- Incomplete VPN client uninstalls that leave behind IPsec policies. When you uninstall a VPN client, use the vendor's cleanup tool if they have one.
- Windows updates occasionally reset IPsec behavior. After a major update, it's worth checking if your VPN still connects.
My rule of thumb: keep a backup of your IPsec policy before making changes. You can export with netsh ipsec static export policy file="ipsecbackup.ipsec". That way, if something goes wrong, you can restore with netsh ipsec static import policy file="ipsecbackup.ipsec".
That's it. You should be back online in under five minutes. If you're still stuck after trying this, the issue might be on the server side — check if the server is also reporting the same error, and if so, apply the same fix there.