Windows Event ID 4948 – Microsoft-Windows-Security-Auditing: IPsec Main Mode Security Association Established

Start by examining the complete event details to understand the IPsec negotiation parameters and endpoint information.

1. Open Event Viewer → Windows Logs → Security
2. Filter for Event ID 4948 using the filter option or search functionality
3. Double-click the most recent Event ID 4948 entry to view detailed information
4. Review the following key fields in the event details:
   • Local Address: Your system's IP address in the IPsec negotiation
   • Remote Address: The peer system's IP address
   • Authentication Method: Kerberos, Certificate, or Pre-shared Key
   • Main Mode Crypto Suite: Encryption and hash algorithms used
   • SA Lifetime: How long the security association remains valid
5. Note the timestamp to correlate with network connectivity issues or policy changes
6. Check for corresponding Event ID 4949 (Main Mode SA deleted) to understand SA lifecycle

Leverage PowerShell to efficiently query and analyze IPsec Main Mode events across multiple systems or time ranges.

1. Open PowerShell as Administrator
2. Query recent Event ID 4948 entries with detailed information:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4948} -MaxEvents 20 | Select-Object TimeCreated, Id, @{Name='RemoteIP';Expression={($_.Message -split '\n' | Where-Object {$_ -like '*Remote Address:*'}) -replace '.*Remote Address:\s*',''}}, @{Name='AuthMethod';Expression={($_.Message -split '\n' | Where-Object {$_ -like '*Authentication Method:*'}) -replace '.*Authentication Method:\s*',''}}

3. Filter events by specific remote IP addresses to track connections from particular endpoints:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4948; StartTime=(Get-Date).AddHours(-24)} | Where-Object {$_.Message -like '*192.168.1.100*'}

4. Count IPsec establishments by hour to identify peak usage patterns:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4948; StartTime=(Get-Date).AddDays(-7)} | Group-Object @{Expression={$_.TimeCreated.ToString('yyyy-MM-dd HH:00')}} | Sort-Object Name

5. Export detailed IPsec event data for further analysis:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4948; StartTime=(Get-Date).AddDays(-30)} | Select-Object TimeCreated, Message | Export-Csv -Path 'C:\Temp\IPsec_Events.csv' -NoTypeInformation

Examine the underlying IPsec policies and current security associations to ensure proper configuration and operation.

1. Check active IPsec policies using netsh:

   netsh ipsec static show all

2. View current Main Mode security associations:

   netsh ipsec dynamic show mmsas

3. Examine Quick Mode SAs that depend on the Main Mode associations:

   netsh ipsec dynamic show qmsas

4. For Windows Firewall with Advanced Security, check connection security rules:

   Get-NetIPsecRule | Where-Object {$_.Enabled -eq 'True'} | Select-Object DisplayName, Profile, Action

5. Verify IPsec service status and configuration:

   Get-Service -Name 'PolicyAgent' | Select-Object Name, Status, StartType

6. Review Group Policy IPsec settings if domain-joined:
   • Open Group Policy Management Console
   • Navigate to Computer Configuration → Policies → Windows Settings → Security Settings → IP Security Policies
   • Verify assigned IPsec policies match your security requirements

Use advanced monitoring tools to track IPsec performance and identify potential security or connectivity problems.

1. Enable IPsec audit logging for comprehensive troubleshooting:

   auditpol /set /subcategory:"IPsec Main Mode" /success:enable /failure:enable

2. Monitor IPsec performance counters using Performance Monitor:
   • Open Performance Monitor (perfmon.exe)
   • Add counters from IPsec AuthIP IPv4 and IPsec AuthIP IPv6 objects
   • Focus on Main Mode Negotiations/sec and Main Mode Negotiation Failures
3. Use Network Monitor or Wireshark to capture IKE traffic for detailed analysis:

   # Enable IPsec logging in Windows Firewall
   Set-NetFirewallProfile -All -LogAllowed True -LogBlocked True -LogFileName 'C:\Windows\System32\LogFiles\Firewall\pfirewall.log'

4. Check for related error events that might indicate problems:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4960,4961,4962,4963; StartTime=(Get-Date).AddHours(-24)} | Select-Object Id, TimeCreated, LevelDisplayName, Message

5. Validate certificate health for certificate-based authentication:

   Get-ChildItem -Path 'Cert:\LocalMachine\My' | Where-Object {$_.EnhancedKeyUsageList -like '*IP security*'} | Select-Object Subject, NotAfter, Thumbprint

Deploy comprehensive monitoring solutions to proactively track IPsec health and security across your infrastructure.

1. Create custom PowerShell monitoring script for automated IPsec health checks:

   # IPsec Health Monitor Script
   $Events = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4948,4960; StartTime=(Get-Date).AddMinutes(-15)} -ErrorAction SilentlyContinue
   $SuccessCount = ($Events | Where-Object {$_.Id -eq 4948}).Count
   $FailureCount = ($Events | Where-Object {$_.Id -eq 4960}).Count
   
   if ($FailureCount -gt 5) {
       Write-EventLog -LogName 'Application' -Source 'IPsec Monitor' -EventId 1001 -EntryType Warning -Message "High IPsec failure rate detected: $FailureCount failures in 15 minutes"
   }

2. Configure Windows Event Forwarding to centralize IPsec events:
   • Set up Event Collector server with wecutil qc
   • Create subscription for Event ID 4948 across domain computers
   • Use XPath query: *[System[(EventID=4948)]]
3. Implement SIEM integration for security correlation:

   # Export IPsec events in SIEM-friendly format
   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4948} -MaxEvents 1000 | ConvertTo-Json -Depth 3 | Out-File 'C:\Logs\IPsec_SIEM_Export.json'

4. Set up scheduled tasks for regular IPsec policy validation:

   $Action = New-ScheduledTaskAction -Execute 'PowerShell.exe' -Argument '-File C:\Scripts\IPsec-HealthCheck.ps1'
   $Trigger = New-ScheduledTaskTrigger -Daily -At '06:00'
   Register-ScheduledTask -TaskName 'IPsec Health Check' -Action $Action -Trigger $Trigger -User 'SYSTEM'

5. Create custom performance counters for business-specific IPsec metrics using Windows Performance Toolkit