Windows error 13856 (ERROR_IPSEC_IKE

Status / error code:		Category:

Constant name:
Source:		Operating System:
Description: IKE could not determine the SSPI principal name for its service credentials.

Previous	Next
ERROR_IPSEC_IKE_SRVACQFAIL	ERROR_IPSEC_IKE_GETSPIFAIL

ERROR_IPSEC_IKE_SRVQUERYCRED

ERROR_IPSEC_IKE_SRVQUERYCRED (0x00003620) The IKE service could not retrieve the principal information associated with its security credentials. In a domain scenario, investigate the machine account, DNS/domain reachability, and any related Kerberos errors before changing crypto proposals.

Identify the principal and authentication package being queried when the failure occurs. That context separates machine-account or domain-security problems from later IKE proposal processing and avoids unnecessary algorithm changes.

What to check

Confirm the computer is correctly domain-joined and can resolve and contact a domain controller.
Check the local Kerberos and LSA event logs for the first credential or principal-name failure.
Compare the configured IPsec authentication method with the intended deployment design.

klist

Microsoft: IKE authentication method types

Microsoft: Remote Access and Always On VPN troubleshooting

Microsoft: IPsec/IKE system error codes

Looking for a different code? Search another status or error code.