Windows 11 Always On VPN: Fix Still Pending

Microsoft confirmed the Windows 11 Always On VPN fix was not delivered in October's update. See affected versions and the single-protocol workaround.

The Windows 11 Always On VPN issue remains unresolved after Microsoft's October 2026 security updates, leaving some organisations dependent on a temporary workaround. On 20 October 2026, Microsoft acknowledged that it had mistakenly marked the problem as resolved, so administrators should verify their VPN profiles instead of assuming the latest Windows update fixed their remote-access connections.

Key Takeaways

• Microsoft acknowledged on 20 October 2026 that the Always On VPN issue had been incorrectly marked as resolved in its October update documentation.
• The problem affects Windows 11 versions 24H2 and later, including affected configurations on versions 25H2 and 26H2.
• The October cumulative updates KB5127648 and KB5127646 did not deliver the expected fix for the affected VPN configurations.
• The failure occurs when a connection attempt fails and Windows tries to switch automatically between IKEv2 and SSTP.
• Microsoft's temporary workaround is to configure an affected VPN profile to use one validated protocol instead of automatic protocol selection, as explained in The Register's 20 October report.

What Changed in the Windows 11 Always On VPN Issue

Microsoft's October security updates were initially reported to have resolved the VPN problem, but the company subsequently corrected that status. The practical consequence is that installing the October updates alone cannot be treated as proof that an affected VPN profile will work correctly.

The issue originated with the September 2026 Windows security updates. According to BleepingComputer's 21 October report, Microsoft had previously marked the problem as resolved before restoring its status to mitigated.

The relevant October cumulative updates include:

• KB5127648: The Windows 11 24H2, 25H2 and 26H2 update, with builds 26100.9711, 26200.9711 and 26300.9711 respectively.
• KB5127646: The Windows 11 26H1 update, build 28000.3231.

Microsoft's official KB5127648 support page records that information about the supposed VPN fix was removed on 20 October. The KB5127646 release notes also record the removal of the claimed fix.

The problem is associated with affected configurations using automatic protocol selection, particularly profiles that try IKEv2 and then fall back to SSTP. It does not mean every Windows 11 computer or every VPN connection is broken.

Why the Unresolved VPN Bug Matters for Remote Work

Always On VPN provides a way for supported Windows devices to establish secure connections to an organisation's network without requiring users to initiate a conventional VPN connection manually every time they need access.

According to Microsoft's Always On VPN documentation, the technology supports remote-access scenarios involving domain-joined, non-domain-joined and Microsoft Entra ID-joined devices.

When the affected fallback process fails, users may see a connection stuck at "Connecting" or repeated unsuccessful connection attempts. Some subsequent attempts can produce the message "The specified port is already in use."

For a remote employee, that can prevent access to internal applications, shared files or other resources available only through the corporate network. For IT administrators, it creates support requests and can disrupt a large group of users if the same VPN profile is deployed across many devices.

The issue also demonstrates why a successful update installation is not equivalent to a successful operational test. Microsoft corrected its own status after the expected behaviour had not been restored, and administrators need to verify their own configurations rather than rely solely on the original release description.

The safest response is to preserve security updates, assess the affected profile and apply the documented mitigation where necessary.

Which Windows 11 Users and Organisations Are Affected

The issue primarily concerns organisations using Always On VPN on Windows 11 devices with automatic protocol selection. The exact impact depends on the installed updates, VPN profile and connection configuration.

In the United States, an organisation deploying Windows 11 24H2 or later across remote employees should check whether its profiles use automatic fallback between IKEv2 and SSTP. If affected users cannot establish a connection, administrators should investigate the profile before repeatedly reinstalling the October update.

In the United Kingdom, an IT team supporting employees who work from home or travel between offices should verify that the selected VPN protocol is supported by its existing gateways and network policies. Switching protocols without checking the infrastructure could introduce another connectivity problem.

In India, businesses operating remote development teams, customer-support centres or distributed offices should check centrally managed Windows devices as well as individually configured laptops. A device may continue to work on one network while failing when the initial connection attempt triggers protocol fallback on another.

The BetaNews report published on 21 October 2026 explains that the workaround removes automatic protocol selection and requires administrators to choose between IKEv2 and SSTP according to their existing infrastructure.

This is not a universal recommendation to prefer one protocol over the other. Organisations should choose the option supported by their network, authentication configuration and security requirements.

Six Steps to Troubleshoot the Windows 11 VPN Connection Bug

Administrators should first establish whether the symptoms match the known issue, then apply the workaround through their normal device-management process.

1. Identify the affected Windows version. Check whether the device runs Windows 11 24H2, 25H2, 26H1 or 26H2. Record the installed cumulative update and operating-system build before making configuration changes.

2. Check the VPN profile. Inspect the Always On VPN profile and determine whether its tunnel type uses automatic protocol selection. Microsoft's documentation and the published troubleshooting coverage explain how the issue relates to profiles that attempt automatic fallback.

3. Confirm the failure pattern. Look for a connection that remains at "Connecting", repeatedly fails after an initial unsuccessful attempt or produces "The specified port is already in use". These symptoms can indicate the known problem, but they do not prove it is the cause.

4. Select one validated protocol. Microsoft's temporary mitigation is to configure the affected profile for IKEv2 only or SSTP only. Choose the protocol that the existing network and VPN gateway support, rather than changing every device to the same option without testing.

5. Apply the change centrally where appropriate. For organisation-managed devices, use the established Intune or VPN-profile deployment process. Test the modified profile on a limited number of devices before rolling it out across the organisation.

6. Verify connectivity and document the result. Confirm that the device can establish its VPN connection, reach the required internal resources and reconnect under the conditions that previously caused failure. Keep the workaround documented until Microsoft provides a verified resolution.

For developers and administrators who also need general technical utilities for related work, the LexoraTools online tools directory provides free browser-based tools. These utilities do not diagnose or repair Windows VPN configuration, so use Microsoft's documentation for the actual remediation.

Worked Example: Checking a VPN Profile Before Changing It

Consider an organisation with 100 Windows 11 laptops using a centrally deployed Always On VPN profile.

• Step 1: Identify all 100 laptops and record their Windows versions and cumulative updates.
• Step 2: Determine how many use automatic protocol selection.
• Step 3: Compare the affected profiles with the known failure pattern.
• Step 4: Test the single-protocol workaround on five representative devices.
• Step 5: If testing succeeds, deploy the validated configuration to the remaining affected devices.
• Step 6: Verify successful connections and record any devices that still fail.

The initial test group represents 5% of the 100-device fleet. This is an illustrative rollout plan, not a sample size prescribed by Microsoft. The organisation should expand testing when different gateways, authentication methods or device configurations introduce additional risk.

Common Windows 11 Always On VPN Mistakes to Avoid

A rushed workaround can restore one connection while introducing another problem elsewhere in the network.

• Assuming KB5127648 or KB5127646 fixed the issue. Microsoft removed the claimed resolution from the relevant update documentation.
• Changing every VPN profile to the same protocol. Select the protocol supported by the organisation's infrastructure and security requirements.
• Confusing the symptom with a confirmed diagnosis. A stuck connection can have causes other than the documented fallback bug.
• Removing security updates to restore connectivity. Follow Microsoft's security guidance and use the documented mitigation rather than automatically rolling back cumulative updates.
• Forgetting to revisit the temporary configuration. Track the affected devices and reassess the profile after Microsoft releases and validates a permanent fix.

Our Take

The most important lesson is to distinguish a Windows update being installed from the underlying problem actually being resolved. Microsoft's correction on 20 October makes profile verification essential for organisations using affected Always On VPN configurations. Apply the single-protocol workaround only after validating the network requirements, and retain the record until an official fix has been confirmed.

What to Watch for the Permanent Windows 11 VPN Fix

Microsoft said that a resolution was planned for an update to be released in the coming weeks, but it had not announced a specific release date in the cited October reports.

Administrators should monitor the official Windows 11 KB5127648 release notes and subsequent Windows servicing announcements for a confirmed resolution.

Until then, keep the affected profiles on the validated workaround, maintain the required security updates and test the next relevant cumulative update in a controlled environment. Do not remove the mitigation merely because a new update has been installed.

Frequently Asked Questions

Is the Windows 11 Always On VPN issue fixed in the October 2026 update?

No. Microsoft acknowledged on 20 October 2026 that the problem had been mistakenly marked as resolved. The October cumulative updates KB5127648 and KB5127646 should not be treated as a confirmed fix for affected configurations. Administrators should verify their profiles and retain the documented workaround until a resolution is confirmed.

Which Windows 11 versions are affected by the Always On VPN problem?

Reports identify affected configurations on Windows 11 24H2 and later, including versions 25H2 and 26H2. The specific impact depends on the installed updates and VPN profile. Check the official release notes and the device's actual configuration before deciding that the known issue explains a connection failure.

Should I choose IKEv2 or SSTP for the temporary workaround?

Choose the protocol supported by your existing VPN infrastructure and validated for your deployment. Microsoft recommends replacing automatic protocol selection with a single protocol for affected profiles. There is no universal choice that suits every organisation, so test the configuration before applying it broadly.

How can I tell whether my VPN connection is affected?

Look for a connection stuck at "Connecting", repeated unsuccessful attempts after the first failure or the message "The specified port is already in use". These symptoms can match the documented issue, particularly with automatic fallback between IKEv2 and SSTP. Other VPN faults can produce similar behaviour, so confirm the profile configuration.

When will Microsoft release a permanent VPN fix?

Microsoft said a resolution was planned for an update in the coming weeks, but the cited reports did not provide a confirmed release date. Monitor the official Windows servicing notes, test the relevant update and verify that the connection works before removing the temporary workaround.