Microsoft has addressed connectivity failures affecting Always On VPN after the September 2026 Windows 11 security updates were deployed.
Always On VPN is a remote access mechanism that operates continuously in the background, creating encrypted connections to corporate networks whenever internet connectivity is established. The technology serves as a successor to the older DirectAccess platform and works with domain-joined machines, non-domain-joined machines, and systems joined to Microsoft Entra ID, spanning Windows 10, Windows 11, and Windows Server installations.
The company had previously claimed the problem was resolved in October 2026 cumulative updates, though this assertion proved premature. Microsoft first disclosed the issue through an alert distributed to IT administrators in late September, identifying the root cause as failures occurring on Windows 11 devices running the September 2026 security patches when automatic protocol selection was enabled alongside IKEv2 and SSTP options.
The resolution arrived this week with the release of KB5127936 preview update. Microsoft stated that "This update fixes an issue that affects Always On VPN connections after installing September security update. When automatic protocol selection or protocol fallback was configured, affected VPN connections could remain stuck in a Connecting state or fail to connect after an initial connection attempt failed. In some cases, subsequent connection attempts could display the error, 'The specified port is already in use.'"
Interim solution for delayed patching
For administrators preferring to defer the preview update and await the standard Patch Tuesday release cycle, Microsoft has documented a temporary mitigation strategy.
The workaround involves selecting a single tunneling protocol rather than relying on automatic selection. According to Microsoft, "IT administrators can mitigate this issue by changing the Always On VPN profile from automatic protocol selection to a single protocol, either SSTP only or IKEv2 only, depending on their environment and configuration. Organizations should select the protocol based on their environment, security, and deployment requirements."
The October 2026 preview update additionally resolves a separate issue where non-administrative users were unable to establish Remote Desktop connections to devices when the "Administrator protection" security feature had been activated following the September 2026 Windows 11 non-security preview update or subsequent Windows releases.