Primary IPsec Troubleshooting in Windows 2000

To troubleshoot IPsec, first enable Audit policy, and then verify the results of phase one and phase two exchanges. When you enable Audit policy, security events are logged in the Security log. By examining the Security log, you can determine whether IKE security association negotiation is successful. To enable Audit policy,
Follow these steps:
1. In Group Policy, expand Local Computer Policy.
2. Locate and then click Computer Configuration/Windows Settings/Security Settings/Local Policies/Audit Policy.
3. In the details pane, right-click Audit logon events, and then click Security.
4. Click to select Success, click to select Failure, and then click OK.
5. In the details pane, right-click Audit object access, and then click Security.
6. Click to select Success, click to select Failure, and then click OK.

Note If you are using a domain policy for auditing, the domain policy overwrites your local policy.

Next, type the following command to use the Netdiag.exe command-line tool:
netdiag /test:ipsec /debug
This command displays debugging information about phase two.

Note To use Netdiag.exe, the Windows 2000 Support Tools package must be installed on your computer. To install the Windows 2000 Support Tools, follow these steps:

1. Start Windows 2000.

Note You must log on as a member of the administrator group to install these tools.
2. Insert the Windows 2000 CD into your CD drive.
3. Click Browse this CD, and then open the Support\Tools folder.
4. Double-click Setup.exe, and then follow the instructions that appear on the screen.

You can also use Netdiag.exe to view the policy without an active connection. To do this, type the following command at a command prompt, and then press ENTER:
netdiag /test:ipsec /v
This command displays the current policy and IPsec statistics with regard to phase one.

If the logged events indicate that phase one Main Mode exchange fails, verify the IKE settings and the IKE authentication methods in your IPsec policy properties. To do this,

Follow these steps:
1. Click Start, click Run, type secpol.msc, and then click OK.
2. Click the IPsec rule that you want to click, right-click IPsec rules and then click Properties.
3. Click the General tab, and then verify that the settings are correct.
4. Click Advanced, examine the settings, click Methods, and then examine the settings.
5. Click OK two times.
6. Click Rules tab, click Edit, and then click the Authentication Methods tab.
7. Examine the settings on this tab.

If the logged events indicate that phase two Quick Mode fails, verify the IPsec security methods in the IPsec rules and in your IPsec policy properties. To do this, follow these steps:

1. Click the IPsec rule that you want to verify, click Edit, and then click the Filter Action tab.
2. Click the filter action that is enabled, click Edit, and examine the settings.

How to use Safe Mode Boot Option in Windows 2000

Windows supports several Safe Boot options that load a minimal set of drivers. You can use these options to start Windows so that you can modify the registry or load or remove drivers.


Follow these steps to use a Safe Boot option

1. Restart your computer, and when the Boot menu appears, press F8.
2. When the Windows Advanced Options menu appears, select an option, and then press ENTER.
3. When the Boot menu appears again, with the words "Safe Mode" displayed in red at the bottom, select the installation you want to start, and then press ENTER.

WARNING: Do not select a Microsoft Windows NT 4.0 installation.

Description of Safe Boot Options

Safe Mode (Safeboot_Option=Minimal): A minimal set of device drivers and services to start Windows.
Safe Mode with Networking (Safeboot_Option=Network): A minimal set of device drivers and services to start Windows plus the drivers necessary to load networking.
Safe Mode with Command Prompt (Safeboot_Option=Minimal): This is the same as Safe mode, with the exception that Cmd.exe is started rather than Windows Explorer.
Enable VGA Mode: This starts Windows in 640 X 480 mode using the current video driver (not Vga.sys). This mode is useful for cases in which the display was configured at a setting the monitor cannot display.

NOTE: Safe mode and Safe mode with Networking load the Vga.sys driver instead.
Last Known Good Configuration: This starts Windows using a previous good configuration.
Directory Service Restore Mode: This mode is valid only for Windows domain controllers. It performs a directory service repair.
Debug Mode: This option enables debug mode in Windows. Debugging information can be sent across a serial cable to another computer running a debugger. This mode is configured to use COM2.
Enable Boot Logging: When the computer is started with any of the Safe Boot options except Last Known Good Configuration, logging is enabled. The Boot Logging text is recorded in the Ntbtlog.txt file in the %systemroot% folder.

An environment variable is set when you use one of the Safe Boot options. The environment variable is "Safeboot_Option." This variable is set to either Network or Minimal.