Microsoft finally fixes VPN issues caused by September Windows 11 updates

Microsoft has resolved Always On VPN connection failures that were triggered after installing the September 2026 Windows 11 security updates. The company confirmed on Wednesday that the fix is available to users who installed this month's KB5127936 preview update. Always On VPN is Microsoft's remote access solution that runs in the background and establishes secure tunnels back to a user's corporate network when their devices connect to the Internet. It has replaced the legacy DirectAccess technology and supports domain-joined, non-domain-joined, and Microsoft Entra ID-joined devices running Windows 10, Windows 11, and Windows Server. The problem first surfaced in late September, when Microsoft acknowledged it in a service alert sent to IT administrators. According to the alert, the Always On VPN failures were triggered on Windows 11 systems by the September 2026 security updates when using automatic protocol selection with IKEv2 and SSTP. The resolution process was not entirely smooth. Microsoft had previously and mistakenly flagged the known issue as fixed in the October 2026 Windows 11 cumulative updates before confirming the actual fix this week. "This update fixes an issue that affects Always On VPN connections after installing September security update," Microsoft said. "When automatic protocol selection or protocol fallback was configured, affected VPN connections could remain stuck in a Connecting state or fail to connect after an initial connection attempt failed. In some cases, subsequent connection attempts could display the error, 'The specified port is already in use.'" For organizations that do not want to install the preview update and would rather wait for next month's Patch Tuesday cumulative updates, Microsoft is also providing a temporary workaround. It requires administrators to choose one of two tunneling protocols to prevent Always On VPN failures on affected devices. "IT administrators can mitigate this issue by changing the Always On VPN profile from automatic protocol selection to a single protocol, either SSTP only or IKEv2 only, depending on their environment and configuration," Microsoft said. "Organizations should select the protocol based on their environment, security, and deployment requirements." The October 2026 preview update also addresses a separate known issue that prevented non-admin users from connecting to devices via Remote Desktop. That problem occurred when the "Administrator protection" security feature was enabled after installing the September 2026 Windows 11 non-security preview update, or Windows updates released since then.