WINDOWS SERVICE
IKEEXT: IKE and AuthIP IPsec Keying Modules
Hosts the Internet Key Exchange (IKE) and Authenticated Internet Protocol (AuthIP) keying modules, which are used for authentication and key exchange in Internet Protocol security (IPsec).
TECHNICAL SUMMARY
| Service name | IKEEXT |
|---|---|
| Display name | IKE and AuthIP IPsec Keying Modules |
| Runs from | C:\Windows\System32\svchost.exe |
| Command line | svchost.exe -k netsvcs -p |
| Runs as | LocalSystem |
| Verdict | Leave it alone |
| Microsoft, Windows Server 2016 guidance | No guidance (Microsoft highly recommends leaving it running) |
Paths, signer and service account observed on Windows 11 build 26300 on 12 November 2026. Run the commands below to check your own PC.
Should you touch it?
Leave it aloneMicrosoft's guidance for Windows 10 and 11 rates it Don't disable, and its Windows Server list highly recommends leaving it running: stopping or disabling it prevents IKE and AuthIP key exchange with peer computers, which can make IPsec fail. Both lists give Manual as the default startup type; on the PC used for this page it was set to Automatic, with a start trigger, and running.
What PC Tweaker does with it
PC Tweaker does not change this service. No control in the catalogue stops it, disables it or edits its start type.
Check it yourself
See its state and start type
PowerShellGet-Service IKEEXT | Format-List Name, DisplayName, Status, StartType sc qc IKEEXT
Common questions
What does the IKEEXT service do?
Hosts the Internet Key Exchange (IKE) and Authenticated Internet Protocol (AuthIP) keying modules, which are used for authentication and key exchange in Internet Protocol security (IPsec). It runs C:\Windows\System32\svchost.exe (svchost.exe -k netsvcs -p) as LocalSystem.
Can I disable IKEEXT?
Leave it alone. Microsoft's guidance for Windows 10 and 11 rates it Don't disable, and its Windows Server list highly recommends leaving it running: stopping or disabling it prevents IKE and AuthIP key exchange with peer computers, which can make IPsec fail. Both lists give Manual as the default startup type; on the PC used for this page it was set to Automatic, with a start trigger, and running.
What depends on IKEEXT?
On Windows 11 build 26300, XboxNetApiSvc (Xbox Live Networking Service) lists IKEEXT as a dependency, and IKEEXT itself depends on BFE (Base Filtering Engine) and nsi (Network Store Interface Service). Microsoft's lists state the rule for service after service: one that explicitly depends on a disabled service cannot start. sc qc IKEEXT prints the dependencies on your PC.
How do I check that it is the real service?
On Windows 11 build 26300 it is registered as svchost.exe -k netsvcs -p, runs as LocalSystem and loads C:\Windows\System32\ikeext.dll, signed by Microsoft Windows. It depends on BFE and nsi and has a trigger registered.