| Previous | Next |
| ERROR_IPSEC_DEFAULT_MM_POLICY_NOT_FOUND | ERROR_IPSEC_DEFAULT_QM_POLICY_NOT_FOUND |
ERROR_IPSEC_DEFAULT_MM_AUTH_NOT_FOUND
Authentication methods are separate from cryptographic proposals
ERROR_IPSEC_DEFAULT_MM_AUTH_NOT_FOUND identifies a missing Main Mode authentication configuration, not a failed certificate or Kerberos exchange. Windows stores authentication methods separately from the Main Mode cryptographic proposals that select encryption, integrity, and Diffie–Hellman parameters. A rule must be able to resolve both kinds of object before negotiation begins.
Review the rule association and the policy-store origin of the authentication set. A local authentication set can be shadowed or replaced by domain policy, while a copied rule can retain an identifier that is not present in the destination GPO. Only after the association is valid should diagnostics move to credential availability, certificate trust, preshared-key agreement, or peer identity.
What to verify first
- The rule points to an existing Phase 1/Main Mode authentication set.
- The set exists in the same writable policy context as the rule.
- A GPO copy operation included associated authentication objects.
- The failure occurs before any IKE authentication exchange is sent.
References
- Microsoft: Main Mode policy-store model
- Microsoft: Main Mode authentication and audit events
- RFC 7296: IKE authentication and SA establishment
Looking for a different code? Search another status or error code.