is IPSEC Authentication between local domain hosts a part of normal behaviour in a Windows network?

Question

I am seeing lot of IPSEC Authentication messages in eventlogs of Windows domain hosts. I was wondering if this - setting up IPSEC connections between domain workstations is a part of normal Windows behaviour?

Answer 1

Short answer is: probably normal.

Windows server 2008 can use IPSec (if configured) for domain and server isolation.

It depends on the configurations and the Group Policies involved. Aside from this answer, you'll need to head over to a Windows admin forum or Superuser for specifics.

Answer 2

yes, the IPSEC protocol is simply said an security protocol over the controller towards the workstations, its part of the regular traffic, so nothing to be worried about