www.BlackViper.com: Windows 7 Services 411 - IPsec Policy Agent

IPsec Policy Agent

Default Description:

Internet Protocol security (IPsec) supports network-level peer authentication, data origin authentication, data integrity, data confidentiality (encryption), and replay protection. This service enforces IPsec policies created through the IP Security Policies snap-in or the command-line tool "netsh ipsec". If you stop this service, you may experience network connectivity issues if your policy requires that connections use IPsec. Also,remote management of Windows Firewall is not available when this service is stopped.

Additional Information:

Most home networks do not use IPsec as it is used for remote VPN connections among other things.

If you use an external hardware firewall/gateway/router between your computer and the internet, do not use IPsec (VPN tunneling, etc) and Internet Connection Sharing (ICS), then this service and the following group of services can be disabled:

• Base Filtering Engine
• IKE and AuthIPsec Keying Modules
• Internet Connection Sharing (ICS)
• IPsec Policy Agent
• Routing and Remote Access
• Windows Firewall

I highly recommend that you do not disable the Windows Firewall unless you use a different software firewall or external hardware solution, but the services listed above are all involved with each other.

Additional Reading:

• ICS: http://en.wikipedia.org/wiki/Internet_Connection_Sharing
• IKE: http://en.wikipedia.org/wiki/IKE
• IPsec: http://en.wikipedia.org/wiki/IPsec
• VPN: http://en.wikipedia.org/wiki/Virtual_private_network

Discussion Topic Link:

Windows 7 Services Forum

Defaults Startup Type:

Windows 7 Starter: Manual
Windows 7 Home Basic: Manual
Windows 7 Home Premium: Manual
Windows 7 Professional: Manual
Windows 7 Ultimate: Manual
Windows 7 Enterprise: Manual

Other Settings:

Safe Setting: Manual

Service Names:

Service Name (registry): PolicyAgent

Display Name: IPsec Policy Agent

Default Path and Command Line Options:

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

Log On As:

Account: Network Service

Dependencies:

What service IPsec Policy Agent needs to function properly:

• Base Filtering Engine (S, HB, HP, P, U, E)
  • Remote Procedure Call (RPC) (S, HB, HP, P, U, E)
    • DCOM Server Process Launcher (S, HB, HP, P, U, E)
    • RPC Endpoint mapper (S, HB, HP, P, U, E)
• TCP/IP Protocol Driver (S, HB, HP, P, U, E)

What other service require IPsec Policy Agent to function properly:

• None (S, HB, HP, P, U, E)

Registry Settings (.reg):

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\PolicyAgent]
"DisplayName"="@%SystemRoot%\\System32\\polstore.dll,-5010"
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,4e,00,65,00,74,00,77,00,6f,00,72,00,6b,00,53,00,65,00,72,00,76,\
00,69,00,63,00,65,00,4e,00,65,00,74,00,77,00,6f,00,72,00,6b,00,52,00,65,00,\
73,00,74,00,72,00,69,00,63,00,74,00,65,00,64,00,00,00
"Description"="@%SystemRoot%\\system32\\polstore.dll,-5011"
"ObjectName"="NT Authority\\NetworkService"
"ErrorControl"=dword:00000001
"Start"=dword:00000003
"Type"=dword:00000020
"DependOnService"=hex(7):54,00,63,00,70,00,69,00,70,00,00,00,62,00,66,00,65,00,\
00,00,00,00
"ServiceSidType"=dword:00000001
"RequiredPrivileges"=hex(7):53,00,65,00,41,00,75,00,64,00,69,00,74,00,50,00,72,\
00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,53,00,65,00,43,00,68,00,\
61,00,6e,00,67,00,65,00,4e,00,6f,00,74,00,69,00,66,00,79,00,50,00,72,00,69,\
00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,53,00,65,00,43,00,72,00,65,00,\
61,00,74,00,65,00,47,00,6c,00,6f,00,62,00,61,00,6c,00,50,00,72,00,69,00,76,\
00,69,00,6c,00,65,00,67,00,65,00,00,00,53,00,65,00,49,00,6d,00,70,00,65,00,\
72,00,73,00,6f,00,6e,00,61,00,74,00,65,00,50,00,72,00,69,00,76,00,69,00,6c,\
00,65,00,67,00,65,00,00,00,00,00
"FailureActions"=hex:80,51,01,00,00,00,00,00,00,00,00,00,03,00,00,00,14,00,00,\
00,01,00,00,00,c0,d4,01,00,01,00,00,00,e0,93,04,00,00,00,00,00,00,00,00,00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\PolicyAgent\Parameters]
"ServiceDll"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,\
00,74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,\
69,00,70,00,73,00,65,00,63,00,73,00,76,00,63,00,2e,00,64,00,6c,00,6c,00,00,\
00
"ServiceDllUnloadOnStop"=dword:00000001
"ServiceMain"="SpdServiceMain"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\PolicyAgent\TriggerInfo]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\PolicyAgent\TriggerInfo\0]
"Type"=dword:00000004
"Action"=dword:00000001
"GUID"=hex:07,9e,56,b7,21,84,e0,4e,ad,10,86,91,5a,fd,ad,09
"Data0"=hex:52,00,50,00,43,00,00,00,54,00,43,00,50,00,00,00,25,00,77,00,69,00,\
6e,00,64,00,69,00,72,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,\
00,32,00,5c,00,73,00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,\
65,00,00,00,70,00,6f,00,6c,00,69,00,63,00,79,00,61,00,67,00,65,00,6e,00,74,\
00,00,00,00,00
"DataType0"=dword:00000002