Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

An ipsec filter rule was deleted in error that has now locked me out of RDP access to the server - very big problem (this is a Windows Web Server 2008 R2 (64-bit) rented from 1&1).

I can connect via the serial console (SAC) and their server support team recommended stopping the IPSec service so I should then be able to connect via RDP and correct the error.

When the net stop "IPsec Policy Agent" command is entered it says:

The IPsec Policy Agent service is stopping..

The IPsec Policy Agent service could not be stopped.

(I tried stopping the Windows firewall, Base Filtering Engine, IKEEXXT, etc and these do stop but never the IPsec Policy Agent).

Does anyone know how to stop it or some other way around this problem please?

My remaining courses of action are:

(1). Try to change the registry to set startup of the IPSec service to 'Disabled' (have to find out how to do this from the command line)

(2). Try to recreate the filter from command line (but the server only seems to understand a small amount of the netsh ipsec commands and complains about the add filter command)

(3). Try to boot into 'Last known good cfg' (problem here is that during a hard reboot - whilst being connected to the SAC - this option isn't coming up when I press F8!)

Any help or suggestions would be gratefully appreciated especially as I spent most of yesterday on this problem and am running out of options.

Thanks Tom

EDIT 1: Tried this but no success -

netsh ipsec static add filterlist name="Allow" description="Allow Specified Traffic"

netsh ipsec static add filter filter="Allow" mirrored="yes" srcaddr=any srcmask="" dstaddr="me" protocol="tcp" srcport="0" dstport="3389"

EDIT 2: Thanks to naxto. The service couldn't be stopped until the startup method was changed to disabled, then it could (without any need to reboot). Many thanks.

share|improve this question
Can you not log on locally via an IPMI / Remote KVM setup? – TomTom Dec 24 '13 at 12:08
Unfortunately not, the SAC is the only access available to me (though I can FTP to it). – tomo7 Dec 24 '13 at 12:18
Hate to ba nasty, but you got what you paid for then. As in - noone should have a server at a remote location without IPMI / KVM in 2013. Big problems now - someone likely has to bo local. – TomTom Dec 24 '13 at 13:15

to change the service startup method with the cli, you can use sc.exe:

sc config servicename start= demand

careful, after start, no space, after '=', you need one. You need to find out how the ipsec service is called (you can look it up in the registry). Sorry, I cannot look it up now, not at work or with a windows host handy.

share|improve this answer
Thanks but no joy: net stop "IPsec Policy Agent" The IPsec Policy Agent service is stopping.. The IPsec Policy Agent service could not be stopped. sc config "IPsec Policy Agent" start= disabled [SC] OpenService FAILED 1060: The specified service does not exist as an installed service. – tomo7 Dec 24 '13 at 13:59
that means "ipsec policy agent" is not the name of the service as it is in the registry. Usually services have longer, more descriptive display names, and shorter, more cryptic, names. You need to find the shorter, more cryptic one. – natxo asenjo Dec 24 '13 at 14:11
sc config "policyagent" start= disabled [SC] ChangeServiceConfig SUCCESS now to see how much further I can get - thanks naxto – tomo7 Dec 24 '13 at 14:12
glad it helped, now you can probably reboot the box – natxo asenjo Dec 24 '13 at 14:15

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.