0

An ipsec filter rule was deleted in error that has now locked me out of RDP access to the server - very big problem (this is a Windows Web Server 2008 R2 (64-bit) rented from 1&1).

I can connect via the serial console (SAC) and their server support team recommended stopping the IPSec service so I should then be able to connect via RDP and correct the error.

When the net stop "IPsec Policy Agent" command is entered it says:

The IPsec Policy Agent service is stopping..

The IPsec Policy Agent service could not be stopped.

(I tried stopping the Windows firewall, Base Filtering Engine, IKEEXXT, etc and these do stop but never the IPsec Policy Agent).

Does anyone know how to stop it or some other way around this problem please?

My remaining courses of action are:

(1). Try to change the registry to set startup of the IPSec service to 'Disabled' (have to find out how to do this from the command line)

(2). Try to recreate the filter from command line (but the server only seems to understand a small amount of the netsh ipsec commands and complains about the add filter command)

(3). Try to boot into 'Last known good cfg' (problem here is that during a hard reboot - whilst being connected to the SAC - this option isn't coming up when I press F8!)

Any help or suggestions would be gratefully appreciated especially as I spent most of yesterday on this problem and am running out of options.

Thanks Tom

EDIT 1: Tried this but no success -

netsh ipsec static add filterlist name="Allow" description="Allow Specified Traffic"

netsh ipsec static add filter filter="Allow" mirrored="yes" srcaddr=any srcmask="0.0.0.0" dstaddr="me" protocol="tcp" srcport="0" dstport="3389"

EDIT 2: Thanks to naxto. The service couldn't be stopped until the startup method was changed to disabled, then it could (without any need to reboot). Many thanks.

Improve this question
3
  • Can you not log on locally via an IPMI / Remote KVM setup?
    – TomTom
    Dec 24, 2013 at 12:08
  • Unfortunately not, the SAC is the only access available to me (though I can FTP to it).
    – tomo7
    Dec 24, 2013 at 12:18
  • 1
    Hate to ba nasty, but you got what you paid for then. As in - noone should have a server at a remote location without IPMI / KVM in 2013. Big problems now - someone likely has to bo local.
    – TomTom
    Dec 24, 2013 at 13:15

2 Answers 2

Reset to default
0

to change the service startup method with the cli, you can use sc.exe: http://technet.microsoft.com/en-us/library/bb490995.aspx

sc config servicename start= demand

careful, after start, no space, after '=', you need one. You need to find out how the ipsec service is called (you can look it up in the registry). Sorry, I cannot look it up now, not at work or with a windows host handy.

Improve this answer
4
  • Thanks but no joy: net stop "IPsec Policy Agent" The IPsec Policy Agent service is stopping.. The IPsec Policy Agent service could not be stopped. sc config "IPsec Policy Agent" start= disabled [SC] OpenService FAILED 1060: The specified service does not exist as an installed service.
    – tomo7
    Dec 24, 2013 at 13:59
  • that means "ipsec policy agent" is not the name of the service as it is in the registry. Usually services have longer, more descriptive display names, and shorter, more cryptic, names. You need to find the shorter, more cryptic one.
    – natxo asenjo
    Dec 24, 2013 at 14:11
  • sc config "policyagent" start= disabled [SC] ChangeServiceConfig SUCCESS now to see how much further I can get - thanks naxto
    – tomo7
    Dec 24, 2013 at 14:12
  • glad it helped, now you can probably reboot the box
    – natxo asenjo
    Dec 24, 2013 at 14:15
0

go to the 'start' button and search for 'services.msc' in the search tab. Enter. In a new window you will find a list of services currently activated on your computer. Look fo 'IPsec Policy Agent'. On the left, click 'Stop the service'.(This will also stop IP Helper). Next, Right-click on 'IPsec Agent' again and select properties. On the general tab, you'll see a option 'Startup type', click "Disable" in it's drop down. Restart, and you're good to go

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .