Microsoft Reverses Windows 11 Always On VPN Fix Announcement
Microsoft has acknowledged that it incorrectly reported a bug causing Always On VPN connectivity problems would be fixed in the October 2026 Windows 11 cumulative update.
Always On VPN replaces legacy DirectAccess technology and supports domain-joined, non-domain-joined, and Microsoft Entra ID-joined devices running Windows 10, Windows 11, and Windows Server.
The feature runs in the background and establishes a secure tunnel to a corporate network whenever a device connects to the Internet.
Windows 11 VPN connections can fail after September update
Microsoft first acknowledged the issue in a service alert sent to IT administrators in late September. The problem affects systems running Windows 11 24H2 or later after installing the September 2026 security updates.
The issue occurs when the first Always On VPN connection attempt fails, such as when automatic protocol selection is configured with IKEv2 or SSTP.
“If automatic protocol selection or protocol fallback is configured, affected VPN connections may remain in a connecting state or may fail to connect after an initial failed connection attempt,” Microsoft said.
In some cases, subsequent connection attempts may display the error: “The specified port is already in use.”
Microsoft incorrectly marked the issue as resolved
After releasing the October 2026 Patch Tuesday Windows 11 cumulative update, Microsoft marked the Always On VPN bug as resolved. However, the issue was not fixed in that update, and a permanent solution will be released at a later date.
Microsoft later corrected the status in its service alert.
“This disclosure was incorrectly updated to Resolved status on October 13, 2026. We have changed its status back to Mitigated,” the company said.
“A resolution to this issue will be included in an update released in the coming weeks. We apologize for any inconvenience or confusion this may cause.”
Temporary workaround for Always On VPN problems
While Microsoft works on a permanent fix, affected organizations can reduce the impact by configuring their Always On VPN profiles to use a single tunneling protocol instead of automatic protocol selection.
Microsoft recommends choosing either SSTP only or IKEv2 only, depending on the organization’s environment and configuration.
“IT administrators can alleviate this issue by changing the Always On VPN profile from automatic protocol selection to a single protocol of SSTP only or IKEv2 only,” Microsoft said. “Organizations should choose protocols based on their environment, security, and deployment requirements.”
September Windows update caused other problems
The September cumulative update is linked to several other issues affecting home and business Windows users. A few days after September’s Patch Tuesday, Microsoft released an emergency out-of-band update addressing problems involving Hyper-V-based Linux virtual machines, Remote Desktop Services, and USB audio.
Microsoft also shared a temporary workaround for an issue that prevents some Windows 11 users from signing in with valid domain credentials. The company is separately working to address a bug that breaks Windows’ built-in File History backup feature.
The overall prevention score can hide what happens after the initial access. If an attacker uses valid credentials, your defenses drop sharply.
The Blue Report 2026 measures defense techniques by technology across 338 million simulations run in customer production environments.
Source: www.bleepingcomputer.com