Link to home
Start Free TrialLog in
Avatar of runsysrun
runsysrunFlag for United States of America

asked on

Server 2003 IPSec Event ID 4292 ocasionally after reboot - Blocking TCP/IP traffic

We reboot our servers weekly, every 7 weeks or so, one of the servers is unreachable and needs to be rebooted.  
Windows Server 2003 R2 Standard edition
I have attached a txt file with the systeminfo output.
This server is not used to create VPN tunnels.

Is there any reason for Server 2003 to run IPSec Service?
Let me know if you need more information, I didn't want to make this too unreadable.
In the Event Log I recieve the following Event:
Event Type:      Error
Event Source:      IPSec
Event Category:      None
Event ID:      4292
Date:            11/16/2008
Time:            12:04:52 PM
User:            N/A
Computer:      SERVER
Description:
The IPSec driver has entered Block mode. IPSec will discard all inbound and outbound TCP/IP network traffic that is not permitted by boot-time IPSec Policy exemptions. User Action: To restore full unsecured TCP/IP connectivity, disable the IPSec services, and then restart the computer.  For detailed troubleshooting information, review the events in the Security event log.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 00 00 00 00 01 00 54 00   ......T.
0008: 00 00 00 00 c4 10 00 c0   ....Ä..À
0010: 01 00 00 00 00 00 00 00   ........
0018: 00 00 00 00 00 00 00 00   ........
0020: 00 00 00 00 00 00 00 00   ........

Thanks,
Lee
ASKER CERTIFIED SOLUTION
Avatar of Netman66
Netman66
Flag of Canada image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial