Microsoft Fixes Windows 11 Always On VPN Connection Failures
Microsoft has fixed a known issue that caused Always On VPN connectivity failures after users installed the September 2026 security updates for Windows 11.
Windows 11 Always On VPN issue explained
Always On VPN is Microsoft’s remote access solution and a replacement for traditional DirectAccess technology. It works with domain-joined, non-domain-joined, and Microsoft Entra ID-joined devices running Windows 10, Windows 11, and Windows Server.
The feature runs in the background and automatically establishes a secure tunnel to a corporate network whenever a device connects to the Internet.
Microsoft first acknowledged the problem in a service alert sent to IT administrators in late September. The bug affected modern systems running Windows 11 24H2 and later when an initial VPN connection attempt failed, such as when automatic protocol selection was configured to use IKEv2 and SSTP.
KB5127648 and KB5127646 fix VPN connection failures
Microsoft released cumulative updates KB5127648 and KB5127646 on Tuesday to resolve the Always On VPN issue on all affected systems.
Microsoft said that VPN connections using automatic protocol selection or protocol fallback could remain stuck in a connecting state or fail after the first connection attempt. In some cases, subsequent connection attempts could display the error, “The specified port is already in use.”
“If automatic protocol selection or protocol fallback is configured, affected VPN connections may remain in a connecting state or may fail to connect after the first connection attempt fails. In some cases, subsequent connection attempts may result in a ‘The specified port is already in use’ error.”
Temporary workaround for Always On VPN
Organizations that cannot immediately install the October 2026 Patch Tuesday updates can use a temporary workaround. IT administrators should change the Always On VPN profile from automatic protocol selection to a single tunneling protocol: SSTP only or IKEv2 only.
Microsoft advised organizations to choose between SSTP and IKEv2 based on their environment, security requirements, and deployment configuration.
“IT administrators can alleviate this issue by changing the Always On VPN profile from automatic protocol selection to a single protocol of SSTP only or IKEv2 only, depending on the environment and configuration. Organizations should choose protocols based on their environment, security, and deployment requirements.”
More Windows update issues reported
Last month, Microsoft released an emergency update to fix a Remote Desktop Services issue. The September 2026 update also caused Hyper-V problems and USB audio issues affecting Windows users at home and in businesses.
This week, Microsoft also confirmed that non-admin users may experience problems connecting to their devices through Remote Desktop after installing the latest Windows updates when the “Administrator Protection” security feature is enabled.
Join Mikko Hypponen and security leaders from the NFL, Chanel, and Atlassian for a 2-hour digital summit about what will change with AI speed attacks, what defenders should stop doing, and how to verify, decide, fix, and revalidate at machine speed.
Source: www.bleepingcomputer.com