Windows Event ID 4960 represents a security audit event generated by the Microsoft-Windows-Security-Auditing provider when IPsec Main Mode authentication fails. This event occurs during the initial phase of IPsec tunnel establishment, specifically when two peers attempt to authenticate each other using Internet Key Exchange (IKE) protocol.
The Main Mode authentication process involves several steps: identity verification, certificate validation (if using certificates), pre-shared key verification (if using PSK), or Kerberos authentication (in domain environments). When any of these steps fail, Windows logs Event ID 4960 with specific details about the failure reason, authentication method attempted, and network endpoints involved.
This event is particularly important in enterprise environments where IPsec policies enforce secure communications between systems. Failed authentication attempts could indicate misconfigured policies, expired certificates, network attacks, or legitimate systems with incorrect credentials. The event provides forensic value for security investigations and helps administrators maintain IPsec infrastructure health.
In Windows Server 2025 and Windows 11 24H2, enhanced logging provides additional context about certificate chain validation failures and improved error codes for troubleshooting. The event integrates with Windows Defender Advanced Threat Protection (ATP) for automated threat detection when unusual patterns of authentication failures occur.
