Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I was in the process of translating some locally defined IPSEC policies on my test systems into group policies. In the process I applied an incomplete policy which was missing the line that allows direct access to my DCS which aren't yet set up for ipsec.

This has locked out my ability to apply the updated policy (which removes these restrictions) from my test systems.

How can I forcibly remove this policy to allow me to continue testing?

share|improve this question
Would it be possible to set up one of your DCs for IPSEC connections? Or are the bits of the IPSEC policy that would allow that to work also missing? – voretaq7 Aug 24 '12 at 19:57
@voretaq7 - I'd love to apply this to our DCs but at this point I don't have approval to do so. This is mostly for a redevelopment project that we're just starting to flesh out. – Tim Brigham Aug 24 '12 at 20:02
up vote 7 down vote accepted

I managed to find a way to address this problem via an old technet reference.

Delete HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\IPSec\GPTIPSECPolicy, unassign the locally assigned policy and reboot.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.