WinSecWiki > Security Settings > Local Policies > Audit Policy > Audit Logon > IPsec Extended

IPsec Extended Mode

IPSec is an IP protocol that provides authentication, integrity and optionally encryption at the packet level. This subcategory records all IPSec extended mode events. Why is this subcategory under Logon/Logoff? Your guess is as good as mine.

There are additional subcategories for quick mode and main mode as well as the IPSec driver itself. You can only configure this category using auditpol.

Coverage on events generated by this category are currently in the Security Log Encyclopedia:

Event ID	Title
4978	During Extended Mode negotiation, IPsec received an invalid negotiation packet.

Back to top

 

Upcoming Webinars Anatomy of a Cloud Hack: The Cloudflare/Okta Compromise – A Story of Tokens, Lateral Movement, Persistence and the Salvation of Zero Trust and Hard MFA Tokens

Additional Resources