Quick answer for advanced users: Open wf.msc, go to Connection Security Rules, find the problematic rule, edit its Authentication Methods tab, remove the duplicate entry that appears twice, then click OK.
What this error actually means
You're trying to create or modify a Windows Firewall IPsec rule (or a Windows Defender Firewall with Advanced Security rule) that uses authentication. The error 0XC022003C fires because you've listed the same authentication method—like Kerberos, NTLM, or certificate-based auth—more than once in the same rule. Windows won't let you save a rule that says, for example, "Require Kerberos" and then "Require Kerberos" again. That's pointless and confusing.
This usually pops up on Windows Server 2019 or 2022 when you're building a connection security rule for site-to-site VPN or domain isolation. It also happens on Windows 10/11 Pro if you've been playing with advanced firewall settings. The error isn't common because most people don't stack duplicate auth methods on purpose—but it's easy to do accidentally when you copy a rule or use a script that adds an extra method.
How to fix the duplicate auth method
Here's the step-by-step. I'm assuming you're on Windows 10 version 22H2 or Windows Server 2022. The process is identical on all supported versions.
-
Open Windows Defender Firewall with Advanced Security. Press Win + R, type
wf.msc, and hit Enter. You'll see the main console window. - Click "Connection Security Rules" in the left pane. This shows all the IPsec rules on your machine.
- Find the rule giving you the error. If you were creating a new rule and the error popped up, you don't have a saved rule yet. Skip to step 4. If you were editing an existing rule, look for the one you just tried to modify. The error often happens on rules named something like "Domain isolation" or "Custom VPN rule."
- Right-click the rule (or the new rule draft) and select Properties. If you were in the middle of creating a rule, you'll have to start over—but note the settings you chose, because you'll need them again. This is the fastest workaround.
- Go to the Authentication Methods tab. This tab has two sections: "First authentication methods" and "Second authentication methods." The error comes from one of these lists having a duplicate entry.
- Look for a method listed twice. For example, you might see "Kerberos V5" listed twice in the first authentication box. Or "Certificate" twice. Select the second instance and click Remove. If you see four entries, check for duplicates in both sections.
- Click Apply, then OK. After you remove the duplicate, you should see the Apply button become active. Click it. No error should appear now.
- Test the rule. Use a ping or an actual connection to verify the rule works. If you get a different error, you probably have another problem (like a missing certificate). That's outside this fix.
After clicking Apply you should see the rule save without any pop-up. The duplicate is gone, and the rule will enforce correctly.
Alternative fix: Delete and recreate the rule
If the above doesn't work—maybe the rule is corrupted or you can't see the duplicate—just delete the rule and start fresh. This is actually the faster route if you're comfortable with the settings. Here's how:
- Backup your current rule settings: take a screenshot of every tab (General, Computers, Protocols, Authentication Methods, Advanced).
- Delete the rule by right-clicking it and choosing Delete.
- Create a new rule: right-click Connection Security Rules and select New Rule. Follow the wizard carefully, making sure you add each auth method only once.
- Name it the same as before to keep your policies organized.
This method works every time because you're starting from a clean slate. It's also a good chance to double-check that you're not inadvertently using the same method twice.
How to prevent this from happening again
Here's what I tell my trainees: always review the Authentication Methods tab before you click Apply. If you're using PowerShell or Group Policy to deploy rules, audit your scripts for duplicate entries. A common mistake is when a script adds a default method and then manually adds another one of the same type.
Also, if you're copying rules from one server to another, export them as XML first (netsh advfirewall export) and check the XML for duplicate <firstAuthMethod> or <secondAuthMethod> elements. Delete the extra one before importing. I've seen this catch errors before they ever hit production.
That's it. You fixed the 0XC022003C error, and your IPsec rule should work as expected. No need to reboot or restart any services—the change takes effect immediately.