Windows Server Event: 4965

Active Directory Auditing Tool

The Who, Where and When information is very important for an administrator to have complete knowledge of all activities that occur on their Active Directory. This helps them identify any desired / undesired activity happening. ADAudit Plus assists an administrator with this information in the form of reports. In real-time, ensure critical resources in the network like the Domain Controllers are audited, monitored and reported with the entire information on AD objects - Users, Groups, GPO, Computer, OU, DNS, AD Schema and Configuration changes with 200+ detailed event specific GUI reports and email alerts.

System Event » Windows Server Event: 4965

Event ID 4965 - IPsec received a packet from a remote computer with an incorrect Security Parameter Index (SPI).

Description IPsec received a packet from a remote computer with an incorrect Security Parameter Index (SPI).
Category System
Subcategory IPSec driver

This log data gives the following information:

  • Remote network address
  • Inbound SA SPI

Reasons to monitor this event:

  • This is usually caused by malfunctioning hardware that is corrupting packets.
  • If these errors persist, verify that the packets sent from the remote computer are the same as those received by this computer.
  • This error might also indicate interoperability problems with other IPsec implementations. In this case, if connectivity is not impeded, then these events can be ignored.

Pro tip:

With in-depth reports, real-time alerts, and graphical displays, ADAudit Plus tracks all IPsec security associations, helping you meet your security, operational, and compliance needs with absolute ease.

Event 4965 applies to the following operating systems:

  • Windows Server 2008 R2 and 7
  • Windows Server 2012 R2 and 8.1
  • Windows Server 2016 and 10