What does Windows error code 13021 (ERROR_IPSEC_MM_POLICY_PENDING_DELETION) mean?

 
Previous Next
ERROR_IPSEC_TUNNEL_FILTER_PENDING_DELETION ERROR_IPSEC_MM_AUTH_PENDING_DELETION

ERROR_IPSEC_MM_POLICY_PENDING_DELETION

ERROR_IPSEC_MM_POLICY_PENDING_DELETION (0x000032DD) The policy has been scheduled for removal but remains visible while the IPsec policy engine finishes cleanup. This is a transitional management state, not a new negotiation error.

What to check for ERROR_IPSEC_MM_POLICY_PENDING_DELETION

  • Confirm that no deployment system is simultaneously recreating the policy.
  • Check rule and security-association state before retrying changes.
  • Use the policy source of truth, such as the applicable GPO, to avoid local-policy and domain-policy races.
Get-NetIPsecMainModeRule

Microsoft: Get-NetIPsecMainModeRule

Microsoft: Get-NetIPsecMainModeSA

Microsoft: IPsec/IKE system error codes

Where the result is returned

This result is Win32 system error 13021 (0x000032DD) from winerror.h. AllStat describes it as “The Main Mode policy is pending deletion.”. The code is useful only together with the API that failed, because multiple Windows components can reuse system-error values while imposing different retry and cleanup rules.

Diagnostic sequence

  • Call GetLastError immediately after the failing API and save this result, the function name, all relevant flags, and the target path, handle, service, device, account, or policy object.
  • Capture the component log that owns the ipsec / mm / policy / pending / deletion operation and retain the original numeric value before a framework converts it to an HRESULT or exception.
  • compare preconditions with the API documentation and reproduce with a minimal request before changing system-wide configuration.

Retry this result only after the resource or state named in “The Main Mode policy is pending deletion.” has changed. For invalid parameters, unsupported formats, missing objects, policy restrictions, and access failures, correct the input or configuration instead of immediately repeating the same call.

Looking for a different code? Search another status or error code.