Before You Start
This error appears when your Windows machine tries to set up a VPN connection (L2TP/IPsec or IKEv2) and the authentication step fails. You'll often see this right after you change your password, or when your certificate expired without you noticing. The good news? Most fixes are quick. Start at the top and work down—stop when the VPN connects.
Fix 1: Quick Credential Check (30 seconds)
This sounds obvious, but I've seen it trip up experienced admins. The error text says "credentials are unacceptable," which usually means a typo or stale password was saved.
- Open Settings > Network & Internet > VPN (Windows 10) or Settings > Network & Internet > VPN (Windows 11).
- Click your VPN connection, then click Advanced options.
- Under Sign-in info, you'll see the saved username and password. Delete the password field and type it again. Don't rely on the dots—make sure you're typing the right characters.
- If you're using a smart card or certificate, skip this step and go to Fix 2.
Expected outcome: After you save and reconnect, the VPN should authenticate. If it doesn't, move on.
Fix 2: Re-check Certificate and Server Settings (5 minutes)
If your VPN uses certificate-based authentication (common in corporate setups), the local machine certificate might have expired or been revoked. Here's how to verify:
- Open certmgr.msc (press Win+R, type it, hit Enter).
- Expand Personal > Certificates. Look for a certificate that matches your VPN server or your user name.
- Double-click it and go to the General tab. Check the Valid from dates. If it's expired, you need a new one from your IT department.
- Also check the Certification Path tab. If the root CA isn't trusted, you'll get this error. If you see a red X, the chain is broken.
Now, check the VPN server address in your connection settings. A small typo in the server name can cause an auth failure because it points to the wrong server. Go back to VPN settings, click Advanced options, and verify the server name or IP.
Expected outcome: If the cert was expired, after you get a new one and import it, the VPN should connect. If not, continue.
One more thing—if your VPN uses a pre-shared key (PSK) instead of a certificate, make sure the PSK is correct. In Advanced options, look for Pre-shared key and re-enter it. Sometimes the key gets corrupted in the saved settings.
Fix 3: Advanced—Registry Tweak for Certificate Mismatch (15+ minutes)
Here's a real-world scenario: you're on Windows 10 and you changed your password last night, but the VPN still fails with 0x35E9. You checked the cert, it's fine. The problem might be that Windows is still sending the old password hash. There's a known workaround that involves clearing cached credentials, but if that doesn't work, we can adjust the registry to force stricter authentication.
Warning: Editing the registry can break things if you're careless. Back up first (File > Export in regedit).
- Press Win+R, type
regedit, hit Enter. - Navigate to
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PolicyAgent. - Right-click on the right pane, choose New > DWORD (32-bit) Value.
- Name it
AssumeUDPEncapsulationContextOnSendRule. - Set its value to
2(this is for NAT traversal—sometimes the auth fail is actually a NAT issue). - Close regedit and reboot.
After the reboot, try connecting again. If that doesn't help, we can try a different approach: resetting the IPsec services.
Reset IPsec Policy Agent
Open an elevated Command Prompt (right-click Start > Windows Terminal (Admin) or Command Prompt (Admin)). Run these commands one by one:
net stop policyagent
net start policyagent
ipconfig /flushdns
This restarts the service that handles IKE authentication. I've seen this clear up weird auth failures after Windows updates.
Expected outcome: After the reboot or service restart, test your VPN. If you still get the error, it's likely a server-side problem—contact your VPN admin and give them the exact error code. They might need to renew the server certificate or check the RADIUS settings.
Final Word
Most people solve this with Fix 1 or Fix 2. The registry tweak is for stubborn cases where NAT is messing with the packets. If you've tried all three and still see 0x35E9, it's not on your end. Call your IT team.