How to fix corrupted IPSec policy on Windows server 2003

 How to fix corrupted IPSec policy on Windows server 2003

 Symptoms

SYMPTOMS:

• 1.     Loss of connectivity to server.
  2.     As server boots past Windows splash screen entering gray backdrop with status window, ping starts.
  3.     When “Acquiring Computer Settings” message appears on status windows prior to login prompt, ping fails and network connectivity is not restored.
  4.     While in the OS, loopback ping and ping to self hostname is successful.
  5.     Server cannot ping anything else on subnet besides it’s self even though network adapter shows connected. 
  6.     Ping-ed gateway and destination is not reachabl
• 7.   IPSEC Service is not started
• 8. "The system cannot find the file specified" when trying to start IPSEC Service
• 9. Other symptoms are found in Microsoft Article KB912023
• References: http://support.microsoft.com/kb/870910 
• References: http://support.microsoft.com/kb/912023

Resolution

On Windows Server 2003 DC, if the IPSEC policy was corrupted, the server machine couldn't determine what traffic was allowed and what traffic wasn't, so it took the safe route and discarded all traffic that wasn't permitted by the highly restrictive boot-time policy exemptions.

In order to fix it, we need to fix some registry keys from the command line:

  REG DELETE HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\
   Policy\Local /F

  REG ADD HKLM\System\CurrentControlSet\Services\IPSEC /V
   Start /T REG_DWORD /F /D 1

  regsvr32 -s polstore.dll

When the policy file corrupted and couldn't be read, IPSec will be defaulted to "Block" mode, it will blocks most traffic except DHCP, which the computer would need to start up. By deleting the local policy, reconfiguring the IPSec service and re-registering the policy store (it will recreates the default local policy), we can solve the problem. For more info, you can reference this MS web page:
http://www.microsoft.com/technet/prodtechnol/windowsserver2003/library/DepKit/b0b6adaa-6b38-4952-b055-14559f46e561.mspx

You may attempt to follow the resolution found in Microsoft Article KB912023, but do consider the following before performing them.

1. Ensure that the server harddisk is in working condition. You may check this thru the storage controller (RAID controller) utility. The usual errors to look out for are faulty harddisk or controller batteries that needs to be replaced.
   
2. Ensure that your file system is intact by running a chkdsk. This is ensure that your file system does not contain errors.
   
   chkdsk {system drive} /f /r
   
3. Ensure that your operating system files are checked for consistency (Be prepared to insert Windows Server 2003 CD). This is important if item 1 and 2 above contains errors on the server.
   
   sfc /scannow
   
4. Delete local policy registry subkey (if present)
   
   HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local
   
5. Rebuild local policy store by running the command
   
   regsvr32 polstore.dll
   
6. Attempt to start service and test network connectivity.
   

 For exact details on step 4 and 5, please refer to Microsoft Article mentioned.