Microsoft has resolved Always On VPN connection failures triggered after installing the September 2026 Windows 11 security updates.
The Always On VPN remote access solution runs in the background and establishes secure tunnels back to the user’s corporate network when their devices connect to the Internet. It has replaced the legacy DirectAccess technology and supports domain-joined, non-domain-joined, and Microsoft Entra ID–joined devices running Windows 10, Windows 11, and Windows Server.
Microsoft has previously mistakenly flagged this known issue as fixed in the October 2026 Windows 11 cumulative updates.
The company first acknowledged it in a service alert sent to IT administrators in late September, saying the Always On VPN failures were triggered on Windows 11 systems by the September 2026 security updates when using automatic protocol selection with IKEv2 and SSTP.
On Wednesday, Microsoft confirmed that this issue has finally been fixed for users who installed this month’s KB5127936 preview update.
“This update fixes an issue that affects Always On VPN connections after installing September security update,” it said. “When automatic protocol selection or protocol fallback was configured, affected VPN connections could remain stuck in a Connecting state or fail to connect after an initial connection attempt failed. In some cases, subsequent connection attempts could display the error, ‘The specified port is already in use.'”
Workaround also available
Microsoft also provides a temporary fix for users who don’t want to install the preview update and would rather wait for next month’s Patch Tuesday cumulative updates.
This requires admins to choose one of two tunneling protocols to prevent Always On VPN failures on affected devices.
“IT administrators can mitigate this issue by changing the Always On VPN profile from automatic protocol selection to a single protocol, either SSTP only or IKEv2 only, depending on their environment and configuration,” Microsoft said.
“Organizations should select the protocol based on their environment, security, and deployment requirements.”
The October 2026 preview update also fixes a known issue preventing non-admin users from connecting to devices via Remote Desktop when the “Administrator protection” security feature is enabled after installing the September 2026 Windows 11 non-security preview update (or Windows updates released since then).
Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.
