Windows Event ID 4962 – Microsoft-Windows-Security-Auditing: IPsec Main Mode Security Association Established

Start by examining the complete event details to understand the IPsec negotiation parameters.

1. Open Event Viewer → Windows Logs → Security
2. Filter for Event ID 4962 using the filter option
3. Double-click the event to view detailed properties
4. Note the following key fields:
   • Source Network Address - Initiating endpoint
   • Destination Network Address - Responding endpoint
   • Authentication Method - Certificate, Kerberos, or PSK
   • Main Mode Crypto Suite - Negotiated algorithms
   • Security Parameter Index (SPI) - Unique SA identifier
5. Cross-reference with corresponding Event ID 4960 (negotiation started) for complete timeline

Use PowerShell to analyze IPsec Main Mode establishment patterns and identify potential issues.

1. Query recent Event 4962 occurrences:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4962} -MaxEvents 50 | Select-Object TimeCreated, @{Name='SourceIP';Expression={($_.Message -split '\n' | Where-Object {$_ -match 'Source Network Address:'} | ForEach-Object {$_.Split(':')[1].Trim()})}}, @{Name='DestIP';Expression={($_.Message -split '\n' | Where-Object {$_ -match 'Destination Network Address:'} | ForEach-Object {$_.Split(':')[1].Trim()})}}

2. Analyze IPsec negotiation frequency by endpoint:

   $Events = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4962} -MaxEvents 1000
   $Events | ForEach-Object {
       $Message = $_.Message
       $SourceIP = ($Message -split '\n' | Where-Object {$_ -match 'Source Network Address:'} | ForEach-Object {$_.Split(':')[1].Trim()})
       [PSCustomObject]@{
           Time = $_.TimeCreated
           SourceIP = $SourceIP
       }
   } | Group-Object SourceIP | Sort-Object Count -Descending

3. Check for authentication method distribution:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4962} -MaxEvents 200 | ForEach-Object {
       $AuthMethod = ($_.Message -split '\n' | Where-Object {$_ -match 'Authentication Method:'} | ForEach-Object {$_.Split(':')[1].Trim()})
       $AuthMethod
   } | Group-Object | Sort-Object Count -Descending

Examine the underlying IPsec policies that triggered the Main Mode negotiation to ensure proper configuration.

1. Check active IPsec policies using netsh:

   netsh ipsec static show all

2. Review current IPsec security associations:

   netsh ipsec dynamic show all

3. For Windows Firewall with Advanced Security policies:

   Get-NetIPsecRule | Where-Object {$_.Enabled -eq 'True'} | Select-Object DisplayName, Profile, Direction, Action

4. Check IPsec Main Mode policies:

   Get-NetIPsecMainModeRule | Format-Table DisplayName, Enabled, MainModeCryptoSet

5. Examine authentication methods configured:

   Get-NetIPsecAuthProposal | Format-Table

6. Verify certificate-based authentication if applicable:

   Get-ChildItem Cert:\LocalMachine\My | Where-Object {$_.EnhancedKeyUsageList -match 'IP security IKE intermediate'}

Investigate IPsec performance metrics and identify potential negotiation problems using advanced monitoring techniques.

1. Enable detailed IPsec logging in the registry:

   Set-ItemProperty -Path 'HKLM\SYSTEM\CurrentControlSet\Services\PolicyAgent\Parameters' -Name 'EnableLogging' -Value 1 -Type DWord

2. Monitor IPsec service performance:

   Get-Counter '\IPSec IKEv1 IPv4\Active Main Mode SAs', '\IPSec IKEv1 IPv4\Main Mode Negotiations/sec' -SampleInterval 5 -MaxSamples 12

3. Check for failed negotiations preceding successful ones:

   $StartTime = (Get-Date).AddHours(-4)
   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4961,4962; StartTime=$StartTime} | Sort-Object TimeCreated | Select-Object Id, TimeCreated, @{Name='EventType';Expression={if($_.Id -eq 4961){'Failed'}else{'Success'}}}

4. Analyze negotiation timing patterns:

   $Events = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4960,4962} -MaxEvents 100
   $Pairs = @{}
   $Events | ForEach-Object {
       $SourceIP = ($_.Message -split '\n' | Where-Object {$_ -match 'Source Network Address:'} | ForEach-Object {$_.Split(':')[1].Trim()})
       $Key = "$SourceIP-$($_.TimeCreated.ToString('yyyyMMddHHmmss'))"
       if($_.Id -eq 4960) { $Pairs[$Key] = @{Start=$_.TimeCreated} }
       elseif($_.Id -eq 4962 -and $Pairs[$Key]) { $Pairs[$Key].End = $_.TimeCreated }
   }
   $Pairs.Values | Where-Object {$_.End} | ForEach-Object {[PSCustomObject]@{Duration=($_.End - $_.Start).TotalSeconds}}

5. Review Windows IPsec service logs:

   Get-WinEvent -LogName 'Microsoft-Windows-PolicyAgent/Operational' -MaxEvents 50 | Where-Object {$_.LevelDisplayName -eq 'Error' -or $_.LevelDisplayName -eq 'Warning'}

Implement comprehensive IPsec monitoring for security compliance and advanced troubleshooting scenarios.

1. Create a custom IPsec monitoring script:

   # IPsec Main Mode Monitoring Script
   $LogName = 'Security'
   $EventID = 4962
   $Hours = 24
   
   $Events = Get-WinEvent -FilterHashtable @{LogName=$LogName; Id=$EventID; StartTime=(Get-Date).AddHours(-$Hours)}
   
   $Report = $Events | ForEach-Object {
       $Message = $_.Message
       $SourceIP = ($Message -split '\n' | Where-Object {$_ -match 'Source Network Address:'} | ForEach-Object {$_.Split(':')[1].Trim()})
       $DestIP = ($Message -split '\n' | Where-Object {$_ -match 'Destination Network Address:'} | ForEach-Object {$_.Split(':')[1].Trim()})
       $AuthMethod = ($Message -split '\n' | Where-Object {$_ -match 'Authentication Method:'} | ForEach-Object {$_.Split(':')[1].Trim()})
       
       [PSCustomObject]@{
           TimeCreated = $_.TimeCreated
           SourceIP = $SourceIP
           DestinationIP = $DestIP
           AuthenticationMethod = $AuthMethod
           RecordId = $_.RecordId
       }
   }
   
   $Report | Export-Csv -Path "C:\Temp\IPsec_MainMode_Report_$(Get-Date -Format 'yyyyMMdd').csv" -NoTypeInformation

2. Set up automated alerting for IPsec policy violations:

   Register-WmiEvent -Query "SELECT * FROM __InstanceCreationEvent WITHIN 10 WHERE TargetInstance ISA 'Win32_NTLogEvent' AND TargetInstance.LogFile = 'Security' AND TargetInstance.EventCode = 4961" -Action {
       $Event = $Event.SourceEventArgs.NewEvent.TargetInstance
       Send-MailMessage -To 'admin@company.com' -From 'ipsec-monitor@company.com' -Subject 'IPsec Main Mode Failure' -Body "Failed negotiation detected at $(Get-Date)" -SmtpServer 'mail.company.com'
   }

3. Configure Windows Event Forwarding for centralized IPsec monitoring:

   wecutil cs subscription.xml

   Where subscription.xml contains IPsec event collection configuration
4. Use Group Policy to standardize IPsec logging across domain:
   • Navigate to Computer Configuration → Policies → Windows Settings → Security Settings → Advanced Audit Policy Configuration
   • Enable Audit IPsec Main Mode and Audit IPsec Quick Mode
   • Configure Success and Failure auditing as required