What causes the Always On VPN connection failures in Windows 11?
The core issue stems from Windows 11's Always On VPN feature, which is designed to automatically establish a secure VPN connection in the background. The problem occurs when the VPN client tries to switch between protocols—IKEv2 and SSTP—if the initial connection attempt fails. This fallback mechanism is currently broken on Windows 11 versions 24H2 through 26H2, causing the connection process to hang indefinitely or fail outright. Users may also encounter errors like “The specified port is already in use.”
Why isn’t the October update fixing the VPN problems?
Microsoft initially claimed that the October 13 Patch Tuesday security updates addressed these VPN issues. However, the company later retracted this, confirming that the bug was mistakenly marked as resolved and remains active. The problematic update did not fix the automatic protocol fallback issue and introduced other unrelated network problems. As a result, IT administrators cannot rely on these patches as a final fix and must await a future update expected in the coming weeks.
How can IT administrators mitigate the VPN problem temporarily?
The only effective workaround until a permanent patch is released involves disabling the VPN feature's automatic protocol switching. Administrators should configure Always On VPN profiles to use a single, fixed protocol—either IKEv2 or SSTP—by pinning the connection to that protocol and turning off the fallback option. This prevents the buggy automatic switching process from triggering and causing connection failures.
Key steps for mitigation:
- Access the VPN profile configuration in your network management tools.
- Disable automatic protocol fallback if enabled.
- Explicitly select and pin the VPN connection to either IKEv2 or SSTP protocol only.
- Deploy the updated, pinned VPN profile to the affected users.
- Monitor the VPN connections for issues and be ready to revert after the patch arrives.
What should users and administrators expect going forward?
A fully tested and permanent fix is expected from Microsoft in an upcoming update scheduled for release in the next several weeks. Until then, organizations relying on Always On VPN for remote connectivity must maintain strict protocol pinning to preserve reliable VPN access. Maintaining open communication with remote users about potential intermittent VPN issues is also important. Administrators should stay informed through official channels to apply the permanent fix as soon as it becomes available.