Windows Security Log Event ID 4651

Operating Systems Windows 2008 R2 and 7
Windows 2012 R2 and 8.1
Windows 2016 and 10
Category
 • Subcategory
Logon/Logoff
 • IPsec Main Mode
Type Success
Corresponding events
in Windows 2003
and before
 
Discussions on Event ID 4651
Ask a question about this event

4651: An IPsec Main Mode security association was established

On this page

An IPsec Main Mode security association was established. Extended Mode was not enabled.  A certificate was used for authentication.

Free Security Log Resources by Randy

Supercharger Free Edition


Centrally manage WEC subscriptions.

Free.

 

Examples of 4651

An IPsec Main Mode security association was established. Extended Mode was not enabled.  A certificate was used for authentication.

Local Endpoint:
   Principal Name: %1
   Network Address: %9
   Keying Module Port: %10

Local Certificate:
   SHA Thumbprint: %2
   Issuing CA:  %3
   Root CA:  %4

Remote Endpoint:
   Principal Name: %5
   Network Address: %11
   Keying Module Port: %12
Remote Certificate:
   SHA thumbprint:  %6
   Issuing CA:  %7
   Root CA:  %8

Cryptographic Information:
   Cipher Algorithm: %15
   Integrity Algorithm: %16
   Diffie-Hellman Group: %17

Security Association Information:
   Lifetime (minutes): %18
   Quick Mode Limit: %19
   Main Mode SA ID: %23

Additional Information:
   Keying Module Name: %13
   Authentication Method: %14
   Role: %20
   Impersonation State: %21
   Main Mode Filter ID: %22

Keep me up-to-date on the Windows Security Log.
Email*:
*We will NOT share this

Top 10 Windows Security Events to Monitor

Free Tool for Windows Event Collection



 

Additional Resources