#ipsec-security

Windows Event ID 4978 – Security: IPsec Main Mode Negotiation Failed

Event ID 4978 indicates that IPsec Main Mode negotiation failed during the establishment of a secure connection. This security event occurs when two endpoints cannot agree on cryptographic parameters or authentication methods.

Windows Event ID 4977 – Microsoft-Windows-Security-Auditing: IPsec Main Mode Security Association Established

Event ID 4977 indicates successful establishment of an IPsec Main Mode security association between two endpoints, confirming secure tunnel creation for encrypted network communication.

Windows Event ID 4962 – Microsoft-Windows-Security-Auditing: IPsec Main Mode Security Association Established

Event ID 4962 logs when Windows successfully establishes an IPsec Main Mode security association between two endpoints, indicating secure tunnel creation for network communications.

Windows Event ID 4948 – Microsoft-Windows-Security-Auditing: IPsec Main Mode Security Association Established

Event ID 4948 indicates successful establishment of an IPsec Main Mode security association between two endpoints, confirming secure tunnel creation for encrypted network communications.

Windows Event ID 4947 – Microsoft-Windows-Security-Auditing: IPsec Policy Agent Service Started

Event ID 4947 indicates the IPsec Policy Agent service has successfully started on the system. This security audit event confirms IPsec policy enforcement is active and ready to secure network communications.