WINDOWS SERVICE
PolicyAgent: IPsec Policy Agent
Enforces IPsec policies created through the IP Security Policies snap-in or the netsh ipsec command-line tool.
TECHNICAL SUMMARY
| Service name | PolicyAgent |
|---|---|
| Display name | IPsec Policy Agent |
| Runs from | C:\Windows\System32\svchost.exe |
| Command line | svchost.exe -k NetworkServiceNetworkRestricted -p |
| Runs as | NetworkService |
| Verdict | Leave it alone |
| Microsoft, Windows Server 2016 guidance | No guidance |
Paths, signer and service account observed on Windows 11 build 26300 on 12 November 2026. Run the commands below to check your own PC.
Should you touch it?
Leave it aloneMicrosoft's guidance for Windows 10 and 11 rates it Don't disable; the Windows Server list gives no guidance. Microsoft states that with the service stopped you may have network connectivity issues if your policy requires connections to use IPsec, and that remote management of Windows Firewall isn't available. Its default startup type is Manual and it has a start trigger: on the PC used for this page it was stopped.
What PC Tweaker does with it
PC Tweaker does not change this service. No control in the catalogue stops it, disables it or edits its start type.
Check it yourself
See its state and start type
PowerShellGet-Service PolicyAgent | Format-List Name, DisplayName, Status, StartType sc qc PolicyAgent
Common questions
What does the PolicyAgent service do?
Enforces IPsec policies created through the IP Security Policies snap-in or the netsh ipsec command-line tool. It runs C:\Windows\System32\svchost.exe (svchost.exe -k NetworkServiceNetworkRestricted -p) as NetworkService.
Can I disable PolicyAgent?
Leave it alone. Microsoft's guidance for Windows 10 and 11 rates it Don't disable; the Windows Server list gives no guidance. Microsoft states that with the service stopped you may have network connectivity issues if your policy requires connections to use IPsec, and that remote management of Windows Firewall isn't available. Its default startup type is Manual and it has a start trigger: on the PC used for this page it was stopped.
Is the IPsec Policy Agent the same as IKEEXT?
They are two services. Microsoft describes PolicyAgent as the service that enforces IPsec policies created through the IP Security Policies snap-in or netsh ipsec, and IKEEXT as the host of the IKE and AuthIP keying modules used for authentication and key exchange in IPsec. On Windows 11 build 26300 both depend on BFE (Base Filtering Engine).
How do I check that it is the real service?
On Windows 11 build 26300 it is registered as svchost.exe -k NetworkServiceNetworkRestricted -p, runs as NetworkService and loads C:\Windows\System32\ipsecsvc.dll, signed by Microsoft Windows. It depends on the Tcpip driver and BFE and has a trigger registered.