| Previous | Next |
| ERROR_WRONG_COMPARTMENT | ERROR_NO_NVRAM_RESOURCES |
ERROR_AUTHIP_FAILURE
The AuthIP negotiation failed before the protected connection was established.
ERROR_AUTHIP_FAILURE is Win32 error 1469 (0x5BD). Authenticated IP can participate in IPsec connection security and uses policy, credentials, peer identity, and cryptographic negotiation. This code does not mean simply that TCP was refused. It points to failure in the authentication or security negotiation associated with reaching the peer, and the decisive details are normally present in IPsec, IKE/AuthIP, Windows Filtering Platform, or event-log diagnostics.
Frequent causes
- the local and remote connection-security rules do not have a compatible authentication method
- computer or user credentials cannot be obtained or validated for the selected policy
- certificates are missing, expired, untrusted, or lack the required enhanced key usage
- the peer identity, DNS name, address, or Kerberos service expectation does not match
- firewall or network address translation interferes with the negotiated IPsec exchange
Information to collect
Capture local and remote IP addresses, ports and protocol, active connection-security rule, authentication method, main-mode and quick-mode state, certificate thumbprints or Kerberos identity, policy source, interface, compartment, and correlated Event Viewer entries. Avoid logging private keys or reusable credentials. Include packet-capture timing only when organizational policy permits inspection of the negotiation.
Investigation order
Verify basic address reachability, then inspect the effective IPsec and firewall policy on both endpoints rather than only the configured policy object. Confirm that each side offers at least one mutually supported authentication and cryptographic combination. Check time synchronization and domain connectivity when Kerberos is involved.
For certificate authentication, validate the full chain, revocation accessibility, subject or SAN matching rules, private-key availability, and machine versus user store. For managed environments, correlate the failure with Group Policy refresh and rule precedence. A successful unprotected test connection does not prove AuthIP policy is correct.
Resolution strategy
Correct the policy or credential mismatch on both peers and retry a new negotiation. Do not permanently disable IPsec as a troubleshooting shortcut on a production path. Use a narrowly scoped temporary rule only when approved, document it, and remove it after diagnosis. Applications should surface 1469 together with the peer and policy identity instead of converting it to a generic timeout.
What this code is not
ERROR_AUTHIP_FAILURE is distinct from an application-layer login failure and from TLS certificate validation. It also differs from ERROR_WRONG_COMPARTMENT, which identifies the local routing context before authentication policy is evaluated.
Example
Two domain servers have connection-security rules, but one was changed from Kerberos to certificate-only authentication. TCP diagnostics show the host online, yet the protected session fails with 1469. Comparing effective rules reveals no shared authentication method; aligning the rules restores the connection.
References
- Microsoft: System Error Codes (1300–1699)
- Microsoft: Windows authentication technologies
- Microsoft: Windows Filtering Platform
Looking for a different code? Search another status or error code.