IPsec QM Policy Not Found (0x32C9) Fixes

You're staring at event log entry or a command-line failure that says ERROR_IPSEC_QM_POLICY_NOT_FOUND (0X000032C9). The translation is blunt: the quick mode policy that should be active for an IPsec connection just isn't there. This usually happens after a Windows update, a Group Policy refresh, or when someone manually deleted a policy via netsh and didn't clean up the association.

What's actually happening here is that the IPsec Service (PolicyAgent) is trying to match an active security association (SA) to a quick mode policy. When it can't find the policy, it fails the negotiation. The key insight is that the policy isn't just missing from the UI — it's missing from the underlying registry store where the service looks. So the fixes below all target that store, directly or indirectly.

Cause 1: Group Policy Object (GPO) no longer applies the policy

The most common trigger I see is a GPO that either got deleted, had its IPsec section removed, or the OU it was linked to changed. When the GPO stops applying, Windows doesn't automatically remove the old policy — but it does stop refreshing it. After a reboot or a policy update, the service tries to load a policy that's not there anymore.

1. Open Group Policy Management Console (gpmc.msc) on a domain controller.
2. Find the GPO that should contain the IPsec policy. Right-click it and select Edit.
3. Navigate to Computer Configuration > Windows Settings > Security Settings > IP Security Policies on Active Directory.
4. Look for your quick mode policy. If it's there, the GPO is fine. If it's not, you need to re-import it.

If the GPO is missing the policy entirely, export an existing policy from a working machine and import it. On a working machine, open the IP Security Policies snap-in, right-click the policy, and select Export to a .ipsec file. Then on the broken machine, import it via the same snap-in.

The real fix for the GPO cause is to re-link or re-apply the policy. Run gpupdate /force on the affected machine after you've fixed the GPO. If the GPO is gone, you're better off creating a fresh policy that matches the original specs — don't try to copy the .ipsec file from another domain, because it carries the old GUID and the service will still get confused.

Cause 2: Corrupted registry entry under the IPsec policy store

Second most common cause is a registry key that got orphaned or corrupted, usually after an incomplete uninstall of a third-party VPN or firewall client. The quick mode policy is stored under HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\History and also under HKLM\SYSTEM\CurrentControlSet\Services\PolicyAgent\PolicyConfig.

If the registry entry has the wrong GUID or points to a missing policy, you get exactly this error. The service looks up the quick mode policy by its GUID and comes up empty.

1. Open regedit as administrator.
2. Navigate to HKLM\SYSTEM\CurrentControlSet\Services\PolicyAgent\PolicyConfig.
3. Look for subkeys that reference quick mode policies. The policy name is usually in the value data of a Name value.
4. If you see a key that references a policy that doesn't exist in the IP Security snap-in, export that key as a backup, then delete it.
5. Reboot.

Be careful with this one. Deleting the wrong key can kill all your IPsec associations. That's why the backup matters. After you delete the orphaned key, the service will reinitialize its policy store from the GPO or local policy, and the error should clear.

Cause 3: Stale IPsec SA or filter that references an old policy

The third cause is less about the policy being missing and more about the active security association being stale. When you change a quick mode policy, existing SAs don't get torn down automatically. They linger until their lifetime expires. During that window, the service might try to reference the old policy to renegotiate — and fail if the policy was deleted.

This one shows up after you've already applied a new policy or removed an old one, and you're still seeing 0x32C9 in the event log or during a connection attempt.

1. Open an elevated command prompt.
2. Run netsh ipsec static show all to see all policies and filters.
3. Look for any quick mode filter that still references the old policy name.
4. If you find one, remove it with netsh ipsec static delete filter or just delete the whole policy set and re-add the correct one.
5. Finally, flush the SAs: netsh ipsec dynamic delete all

That last command is the kill switch. It dumps every SA and filter, forcing the service to rebuild everything from the static policy store. It's a bit heavy-handed, but it's the only reliable way to clear stale state. It will briefly drop any active IPsec connections, so do it during a maintenance window.

Quick reference

The fastest diagnostic is to run netsh ipsec static show all and look at what policies exist. If your expected quick mode policy isn't listed, that's your smoking gun. Then the fix is either re-importing it via GPO or the local snap-in. If it is listed but you still get the error, jump straight to the registry check.