Microsoft has fixed Always On VPN connectivity failures affecting Windows 11 devices after the September 2026 security updates. The issue caused VPN connections using automatic protocol selection with IKEv2 and SSTP to remain stuck while connecting, fail after the first attempt, or sometimes display a “The specified port is already in use” error.
Microsoft fixes Windows 11 Always On VPN failures
Always On VPN runs in the background and establishes a secure tunnel to a corporate network when a device connects to the internet. The technology replaces traditional DirectAccess and supports domain-joined, non-domain-joined, and Microsoft Entra ID-joined devices running Windows 10, Windows 11, and Windows Server.
Microsoft first acknowledged the problem in a service alert sent to IT administrators in late September. The company said the failures affected Windows 11 systems with automatic protocol selection enabled for IKEv2 and SSTP.
Microsoft had previously incorrectly marked the issue as resolved in the October 2026 Windows 11 cumulative update. The company confirmed on Wednesday that it has now been fixed for users who install the October 2026 preview update, KB5127936.
“This update fixes an issue that affects Always On VPN connections after installing the September security updates,” Microsoft said.
“If automatic protocol selection or protocol fallback is configured, affected VPN connections may remain in a connecting state or fail to connect after the first connection attempt fails. In some cases, subsequent connection attempts may result in a ‘The specified port is already in use’ error.”
Workaround for affected Always On VPN devices
Administrators who do not want to install the preview update can use a temporary workaround while waiting for the next Patch Tuesday cumulative update. Microsoft recommends changing the Always On VPN profile from automatic protocol selection to a single tunneling protocol.
“IT administrators can alleviate this issue by changing the Always On VPN profile from automatic protocol selection to a single protocol of SSTP only or IKEv2 only, depending on the environment and configuration,” Microsoft said.
“Organizations should choose protocols based on their environment, security, and deployment requirements.”
Other issue fixed in the October preview update
KB5127936 also resolves a known issue that prevents non-administrator users from connecting to a device through Remote Desktop when the “Administrator Protection” security feature is enabled. The problem began after installing the September 2026 Windows 11 non-security preview update or any Windows update released afterward.
The overall prevention score can hide what happens after the initial access. If an attacker uses valid credentials, your defenses drop sharply.
The Blue Report 2026 measures defense techniques by technology across 338 million simulations run in customer production environments.
Source: www.bleepingcomputer.com