Fix STATUS_IPSEC_REPLAY_CHECK_FAILED (0XC0360004) on Windows

When this error hits

You're trying to connect to your company VPN from a coffee shop. Or maybe you're using Remote Desktop (RDP) to get into a server. Everything works for a few minutes, then the connection drops. Windows Event Viewer shows STATUS_IPSEC_REPLAY_CHECK_FAILED with code 0xC0360004. I've seen this on Windows 10 22H2 and Windows 11 23H2 mostly.

The real trigger? A VPN server or router that's sending packets out of order. This is common on older VPN gateways or when you're on a flaky Wi-Fi connection. IPsec has a security feature that checks packet sequence numbers. When numbers repeat or arrive in the wrong order, it blocks the connection.

Root cause – why it happens

IPsec replay protection works like a video game anti-cheat. Each packet has a sequence number. If packet #5 shows up after packet #3, the system thinks someone is replaying old packets to break encryption. In reality, it's usually a network issue – a slow router, load balancer, or VPN concentrator that mixes up the order.

The default replay window in Windows is pretty small – about 32 packets. If your network path has high latency or packet reordering, you'll hit this error fast. I've seen it on connections that go through three or four VPN hops. The fix is either to increase the replay window or disable replay protection (not recommended for secure connections).

Fix – step by step

I'll give you two fixes. Try the first one – it works for most people. Skip the second one if you're not comfortable with the command line.

Fix 1: Reset IPsec policy using netsh

1. Open Command Prompt as Administrator. Hit Windows Key + X and pick Terminal (Admin).
2. Type this command and press Enter:

   netsh ipsec static set policy name="MyPolicy" assigned=yes

3. Now restart the IPsec service:

   net stop IKEEXT
   net start IKEEXT

4. Reboot your PC. Yes, you need to reboot. Just restarting the service doesn't always clear the replay counter.
5. Try your VPN or RDP connection again.

This fix resets the IPsec security associations. It forces Windows to renegotiate the replay window with the remote server. Most of the time, this clears the mismatch. I've used this on three different VPN clients (Cisco AnyConnect, OpenVPN, and Windows built-in L2TP).

Fix 2: Increase the replay window via registry

If fix 1 didn't help, you can tell Windows to accept a larger replay window. This is riskier – bigger window means less protection against replay attacks. But in a trusted network, it's fine.

1. Press Windows Key + R, type regedit, and hit Enter.
2. Go to:

   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\IKEEXT\Parameters

3. Right-click in the right pane, pick New > DWORD (32-bit) Value.
4. Name it MaxPacketCount.
5. Double-click it and set the value to 64 (decimal). This doubles the default window.
6. Close Registry Editor and reboot.

I usually set this to 128 if 64 doesn't help. But 64 is enough for most home and small office networks. Don't go above 256 unless you know what you're doing – you're weakening the encryption.

What to check if it still fails

Sometimes the problem isn't on your PC. Here's what else to look at:

• VPN server settings – Check if the server has replay protection enabled. Some older VPN servers have a toggle for it.
• Router or firewall – If you're behind a corporate firewall, ask your network team to check if there's packet reordering happening. A misconfigured load balancer can cause this.
• Network latency – High ping (over 200ms) can trigger replay failures. Try a wired connection instead of Wi-Fi.
• Driver updates – Update your network card driver. I've seen Realtek and Intel Ethernet adapters cause this with outdated drivers. Go to the manufacturer's site, not Windows Update.

If none of this works, you might need to disable IPsec hardware offload in the network adapter properties. It's a checkbox under Advanced tab in the adapter settings. Some older adapters handle IPsec poorly and drop packets.

I remember one case where a guy had this error every time he connected from a hotel Wi-Fi. Turned out the hotel's router was reordering packets on purpose to save bandwidth. We bumped the replay window to 256 and it worked like a charm.

You don't have to worry about this error destroying your system. It's annoying but fixable. Try fix 1 first, then the registry tweak. If you're still stuck, check the server side – it's probably not you.