Windows Event ID 4947 – Microsoft-Windows-Security-Auditing: IPsec Policy Agent Service Started

Check the Security log to confirm the IPsec Policy Agent started successfully and review related events.

1. Open Event Viewer by pressing Win + R, typing eventvwr.msc, and pressing Enter
2. Navigate to Windows Logs → Security
3. Filter for Event ID 4947 using the Filter Current Log option
4. Review the event details including timestamp and user context
5. Check for any related IPsec events (4945, 4946, 4948) that might indicate policy issues

# PowerShell command to check recent 4947 events
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4947} -MaxEvents 10 | Format-Table TimeCreated, Id, LevelDisplayName, Message -Wrap

Verify the IPsec Policy Agent service is properly configured and running with correct startup parameters.

1. Open Services console by pressing Win + R, typing services.msc, and pressing Enter
2. Locate IPsec Policy Agent service in the list
3. Right-click and select Properties to check startup type and dependencies
4. Verify the service is set to Automatic startup type
5. Check the Dependencies tab to ensure required services are available

# Check PolicyAgent service status and configuration
Get-Service -Name PolicyAgent | Format-List *

# View service startup type and dependencies
Get-WmiObject -Class Win32_Service -Filter "Name='PolicyAgent'" | Select-Object Name, StartMode, State, PathName

Examine the current IPsec policies to understand what security rules triggered the Policy Agent startup.

1. Open Local Security Policy by typing secpol.msc in Run dialog
2. Navigate to IP Security Policies on Local Computer
3. Review assigned policies and their rules
4. Check Group Policy Management Console for domain-based IPsec policies if domain-joined
5. Verify policy assignment and rule configuration

# Display current IPsec policies using netsh
netsh ipsec static show all

# Check IPsec policy assignment
netsh ipsec static show gpoassignedpolicy

# View active IPsec associations
netsh ipsec dynamic show all

Examine registry settings that control IPsec Policy Agent behavior and policy storage locations.

1. Open Registry Editor by pressing Win + R, typing regedit, and pressing Enter
2. Navigate to HKLM\SYSTEM\CurrentControlSet\Services\PolicyAgent
3. Review service parameters and startup configuration
4. Check HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local for local policies
5. Examine HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Cache for cached domain policies

# Query PolicyAgent service registry configuration
Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\PolicyAgent" | Format-List

# Check IPsec policy registry locations
Get-ChildItem -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy" -Recurse | Select-Object Name

Perform comprehensive analysis by correlating Event ID 4947 with other system and security events to identify potential issues.

1. Enable IPsec audit logging in Group Policy under Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration
2. Monitor System log for PolicyAgent service events (Event IDs 7034, 7035, 7036)
3. Check Application log for IPsec-related application errors
4. Use Windows Performance Monitor to track IPsec performance counters
5. Analyze network connectivity issues that might be related to IPsec policy enforcement

# Comprehensive event analysis for IPsec troubleshooting
$Events = @(4945, 4946, 4947, 4948, 5049, 5050, 5051, 5052)
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=$Events; StartTime=(Get-Date).AddHours(-24)} | Sort-Object TimeCreated

# Check for PolicyAgent service events in System log
Get-WinEvent -FilterHashtable @{LogName='System'; ProviderName='Service Control Manager'} | Where-Object {$_.Message -like '*PolicyAgent*'}