What does Windows error code 13854 (ERROR_IPSEC_IKE_FAILQUERYSSP) mean?

Status / error code:		Category:

Constant name:
Source:		Operating System:
Description: IKE could not query the Kerberos security package for its maximum token size.

Previous	Next
ERROR_IPSEC_IKE_FAILSSPINIT	ERROR_IPSEC_IKE_SRVACQFAIL

ERROR_IPSEC_IKE_FAILQUERYSSP

ERROR_IPSEC_IKE_FAILQUERYSSP (0x0000361E) The IKE service could not obtain required information from the Kerberos SSPI package. This matters only when the IPsec policy uses domain-based authentication; it can be normal for configurations that intentionally do not use Kerberos.

What to check

Confirm which authentication method the connection-security or VPN rule expects.
For Kerberos-based rules, verify domain connectivity, DNS, time synchronization, and the health of the machine account.
Review the first Kerberos or LSA error in the local logs rather than treating this as a generic VPN-port problem.

klist

Microsoft: IKE authentication method types

Microsoft: Remote Access and Always On VPN troubleshooting

Microsoft: IPsec/IKE system error codes

Looking for a different code? Search another status or error code.