Windows Security Log Event ID 4650
| Operating Systems |
Windows 2008 R2 and 7
Windows 2012 R2 and 8.1
Windows 2016 and 10
Windows Server 2019 and 2022
|
Category
• Subcategory | Logon/Logoff
• IPsec Main Mode |
|
Type
|
Success
|
Corresponding events
in Windows
2003
and before |
|
4650: An IPsec Main Mode security association was established
On this page
An IPsec Main Mode security association was established. Extended Mode was not enabled. Certificate authentication was not used.
Free Security Log Resources by Randy
Supercharger Free Edition
Your entire Windows Event Collection environment on a single pane of glass.
Free.
An IPsec Main Mode security association was established. Extended Mode was not enabled. Certificate authentication was not used.
Local Endpoint:
Principal Name: jsmith@srv1.dmn
Network Address: 10.40.1.123
Keying Module Port: 500
Remote Endpoint:
Principal Name: DMN/SRV2$
Network Address: 10.40.1.101
Keying Module Port: 500
Security Association Information:
Lifetime (minutes): 480
Quick Mode Limit: 0
Main Mode SA ID: 9
Cryptographic Information:
Cipher Algorithm: 3DES
Integrity Algorithm: SHA1
Diffie-Hellman Group: DH group 2
Additional Information:
Keying Module Name: IKEv1
Authentication Method: Kerberos
Role: Responder
Impersonation State: Not enabled
Main Mode Filter ID: 71695
Top 10 Windows Security Events to Monitor
Free Tool for Windows Event Collection