Ipsecpol.exe: Internet Protocol Security Policies Tool

This command-line tool configures Internet Protocol Security (IPSec) policies in the directory service, or in a local or remote registry. It does everything that the IPSec Microsoft Management Console (MMC) snap-in does, and is even modeled after the snap-in.

IPSecPol has two mutually exclusive modes: static and dynamic. The default mode is dynamic.

Dynamic mode plumbs policy into the Policy Agent, which is active only for the lifetime of the Policy Agent service. This means it will not be active after a reboot or stopping of the service. The benefit of dynamic mode is that the policy can co-exist with directory service-based policies, which override any local policy not plumbed by IPSecPol.

Static mode creates or modifies stored policy. This policy can be used again and will last the lifetime of the store. This is the mode that the IPSec MMC snap-in uses. Static mode is indicated by the -w flag. The flags listed for static mode in the syntax listing are valid only for static mode. The usage for static mode is an extension of dynamic mode, so please read through the dynamic mode section.

This tool runs only on Microsoft® Windows® 2000.

Why Use IPSecPol?

• If you have a large and/or complex IPSec policy that you want to configure, IPSecPol can help you by providing a scriptable way to create that policy. Just put your IPSecPol commands into a batch file.

 



Note

This also provides a backup in case you lose the directory service or registry that the policy is stored in. Just re-run the batch file.

• IPSecPol facilitates just-in-time policy with its batch ability. If someone wants a secured channel with your server, simply send them the tool binaries and the command line or batch file to run.
• If your computer is using directory service policy and you want to add rules that will allow you to speak IPSec to computers not covered in the directory service policy, use IPSecPol dynamic mode.
• If you prefer command-line tools to GUI applications, use IPSecPol.

For a more thorough explanation of IPSec policy terminology, see the online Help for the IPSec MMC snap-in.

Requirements

You must have specific privileges for both dynamic and static mode. For static mode, you must have read/write access to the storage that you write. For dynamic mode, you must have Administrator privileges on the computer to which you are plumbing the dynamic policy.

IPSecPol Topics

• IPSecPol Syntax
• IPSecPol Example

Files Required

• Ipsecpol.exe
• Ipsecutil.dll
• Text2pol.dll