| Previous | Next |
| ERROR_IPSEC_QM_POLICY_NOT_FOUND | ERROR_IPSEC_MM_POLICY_EXISTS |
ERROR_IPSEC_QM_POLICY_IN_USE
Configuration references must be removed before the policy object
ERROR_IPSEC_QM_POLICY_IN_USE indicates a dependency in the IPsec configuration graph. A Quick Mode cryptographic set can be associated with one or more connection-security rules. Removing the set first would leave those rules without the proposals needed to negotiate data-protection SAs, so Windows rejects the deletion.
This is not proof that packets are currently flowing through the policy. An object can remain “in use” because a disabled rule, a rule from another policy store, or generated policy still references it. Query associations and policy-store source, then remove or redirect the dependent rules before deleting the set. Clearing live SAs alone does not resolve a configuration reference.
Dependency-oriented cleanup
- List IPsec rules associated with the Quick Mode crypto set.
- Include disabled and Group Policy-sourced rules in the search.
- Move rules to a replacement crypto set before removing the old object.
- Recheck the active resultant policy after Group Policy refresh.
References
- Microsoft: remove sets by associated IPsec rule
- Microsoft: query sets by association and source
- Microsoft: WFP object associations and lifetimes
Looking for a different code? Search another status or error code.