Fix ERROR_IPSEC_IKE_FAILQUERYSSP 0x0000361E on Windows

Why this happens and what we're fixing

This error shows up when Windows tries to set up an IPsec tunnel but can't get the max token size from the Kerberos security provider. I've seen this on Windows Server 2016, 2019, and even Windows 10 Pro when connecting to a corporate VPN. The exact error in the event log is: ERROR_IPSEC_IKE_FAILQUERYSSP with code 0x0000361E. The most common culprit is a broken Kerberos SSP (Security Support Provider) registration in the registry. Let's fix that first.

Cause #1: Corrupted Kerberos SSP registry key

This is the fix that works 9 times out of 10. Windows stores the list of security providers in a registry key. If that key gets corrupted — often after a bad Windows update or a security software uninstall — IPsec can't query Kerberos.

How to check and fix the registry

1. Open Registry Editor as Administrator (press Win+R, type regedit, right-click and run as admin).
2. Go to: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SecurityProviders
3. Look at the value data. It should be a comma-separated list that includes kerberos.dll. A typical healthy value looks like:

   credssp.dll, digest.dll, ntlmssp.dll, kerberos.dll, negotiate.dll, pku2u.dll

4. If you see any of these: extra spaces, wrong DLL names, or missing entries — fix it. The most common mistake I've seen is a kerberos.dll with a trailing space. Remove it.
5. Set the value exactly to the string above. No extra spaces. No line breaks.
6. Reboot the machine.

After the reboot, try your IPsec connection again. This fix alone worked for me on a Windows Server 2019 that started throwing the error after a KB patch in December 2023.

Cause #2: Missing or outdated Kerberos crypto keys

If the registry fix didn't help, the next place to look is the Kerberos keytab or the machine's crypto keys. This is rarer, but I've seen it on domain-joined machines after a domain controller migration.

Re-create the Kerberos machine account key

1. Open Command Prompt as Administrator.
2. Run this command to reset the machine account's Kerberos key:

   netdom resetpwd /server:<YourDomainController> /userd:<DomainAdmin> /passwordd:*

   Replace <YourDomainController> with your DC's name (like DC01.contoso.com) and <DomainAdmin> with a domain admin username. It will prompt for the password.
3. After that, reboot and test.

If you don't have netdom installed, you can use PowerShell instead:

Reset-ComputerMachinePassword -Server <YourDomainController> -Credential (Get-Credential)

This forces Windows to renegotiate the Kerberos trust with the domain controller. I had a client where the DC had a stale key — this command fixed it instantly.

Cause #3: Third-party VPN or firewall software interfering

Sometimes the error isn't Windows itself — it's a VPN client or a firewall driver that hooks into the IPsec stack. I've seen this with older versions of Cisco AnyConnect (pre-4.8) and with some Palo Alto GlobalProtect clients.

How to test and fix

1. Temporarily disable the VPN software. Not just disconnect — actually stop the service or unload the driver.
2. If you can't uninstall, try booting into Safe Mode with Networking. If the error goes away in Safe Mode, you've found the culprit.
3. Update the VPN client to the latest version. For Cisco AnyConnect, version 4.10 or later fixed this on Windows 10 22H2.
4. If updating doesn't help, check the VPN vendor's documentation for a registry fix specific to their software. Some have a key that bypasses Kerberos query.

One workaround that sometimes works: disable IPsec offload in the VPN client's settings. On GlobalProtect, look for "IPSec Hardware Offload" and turn it off. This forces the software to handle IPsec directly, avoiding the broken SSP query.

Quick-reference summary table

If none of these work, check if any recent Windows update broke Kerberos. I've had to roll back KB5021233 on a few machines. But start with the registry — it's the quickest win.