Microsoft Admits October Update Didn't Fix the Windows 11 Always On VPN Bug

Microsoft has admitted that a Windows 11 bug breaking Always On VPN connections was never actually fixed. The company marked it as resolved with its October 2026 Patch Tuesday update, then quietly changed it back. A real fix is now promised “in the coming weeks”.

If you manage Windows laptops at work, this one’s for you. If you use a VPN app like NordVPN or Proton VPN at home, you can probably relax, and we’ll explain why.

What happened

The bug first appeared after Microsoft’s September 2026 security updates for Windows 11. It affects Always On VPN, the built-in Windows feature companies use to keep employee laptops connected to the corporate network automatically. Microsoft acknowledged the problem in a service alert to IT admins in late September.

Then, with the October cumulative update, the issue was marked Resolved. It wasn’t. On 20 October, The Register reported that Microsoft had reverted the status of the issue (tracked as WI1482218) to Mitigated, with this note:

“This disclosure was mistakenly updated to Resolved status on October 13, 2026. We have returned its status to Mitigated.”

Microsoft added that “a resolution for this issue is planned to be included in an update to be released in the coming weeks.” BleepingComputer reported on 21 October that Microsoft apologised for the confusion.

What Always On VPN is, in plain English

Always On VPN is Microsoft’s replacement for DirectAccess, the older system that kept company laptops connected to the office network. The idea is simple: as soon as an employee’s laptop has internet access, Windows opens a VPN tunnel back to the company without anyone clicking anything. Admins push the profile out centrally, usually through Microsoft Intune or Group Policy, and users often don’t know it exists until it breaks.

It can connect with IKEv2, a fast protocol that copes well with switching between networks, or SSTP, which runs over the same port as normal HTTPS traffic and gets through most firewalls. The automatic setting tries one and falls back to the other. That fallback is exactly where this bug lives.

When it fails, remote staff lose access to internal file shares, intranet sites and business apps, which is why help desks noticed quickly in September.

Which systems are affected

According to both reports:

• Windows 11 24H2 and later, which in practice means 24H2, 25H2 and 26H2
• Devices using Always On VPN, whether domain-joined, non-domain-joined or joined to Microsoft Entra ID
• Profiles that fall back to another connection method after a first attempt fails. The typical case is automatic protocol selection, where Windows tries IKEv2 and then SSTP

The symptoms are hard to miss. The connection sits on “Connecting” or keeps retrying. Later attempts can fail with the error “The specified port is already in use.”

The Register notes that the underlying bug goes back to Windows 10, but the September update is what made it surface on current Windows 11 builds.

The workaround

Microsoft’s workaround hasn’t changed since September: stop letting Windows pick the protocol automatically. Admins should set the Always On VPN profile to a single protocol, either SSTP only or IKEv2 only, depending on what their VPN gateway and security requirements support.

That’s easy to push through Intune or Group Policy, but it has trade-offs. IKEv2 is usually faster and handles network changes well. SSTP runs over port 443, so it gets through hotel and guest Wi-Fi firewalls that block IKEv2. Picking one means losing the fallback that made automatic mode attractive in the first place. If your staff travel a lot, SSTP is the safer single choice. If they mostly work from home and the office, IKEv2 is the better experience.

Does this affect NordVPN, Proton VPN or other VPN apps?

Very unlikely. Neither report mentions consumer VPN apps, and the technical picture explains why. Always On VPN is a feature of Windows’ built-in VPN client, configured by an organisation’s IT department. Consumer VPN apps install their own client and connect with their own protocols, mostly WireGuard-based ones like NordLynx, or OpenVPN.

So if your home VPN app is misbehaving, this bug probably isn’t the cause. Check the usual suspects first: an outdated app, a network adapter that needs resetting, or a firewall rule. Our guide to VPN disconnection fixes covers them.

The one exception is if you set up a VPN manually in Windows settings (Settings, Network and internet, VPN) and chose “Automatic” as the VPN type. That uses the same built-in client. If it started failing after the September update, switch the VPN type to a single protocol, or better, use your provider’s own app. Our Windows 11 VPN setup guide shows both methods.

If you’re choosing a VPN for a personal Windows PC, NordVPN is our top pick at 4.63/5, with its own Windows app, a kill switch and a PwC-audited no-logs policy.

Get NordVPN for Windows

How to tell if you use Always On VPN

If you’re an employee rather than an admin:

1. Open Settings, then Network and internet, then VPN.
2. Look for a VPN connection you didn’t create, usually named after your company.
3. If it says it’s managed by your organisation, or it connects on its own when you sign in, that’s likely Always On VPN.

If it’s stuck on “Connecting”, don’t try to fix it yourself by deleting the profile. Tell your IT team. They’ll need to apply the single-protocol workaround centrally, and removing a managed profile can lock you out of company resources.

Not the only Windows VPN problem this month

This is the second Windows VPN issue we’ve covered in a week. The October update KB5127648 also enforces an NTLMv1 block that breaks some VPN and Wi-Fi logins using MS-CHAPv2. That’s a different problem with a different fix, and we explain it in our piece on KB5127648 and VPN/Wi-Fi authentication.

BleepingComputer also lists other fallout from the September updates: Hyper-V, Remote Desktop Services and USB audio problems that needed emergency out-of-band patches, a domain credential login issue with a temporary workaround, and a File History backup bug Microsoft is still working on. It’s been a rough two months for Windows admins.

Want to compare all VPNs side by side? Check our full VPN comparison table with scores across 18 criteria.

Our take

Bugs happen. Marking one as fixed when it wasn’t is worse, because it tells admins they can undo their workaround. Anyone who rolled their Always On VPN profiles back to automatic mode after 13 October may have broken remote access for their own users.

Our advice to IT teams: keep the single-protocol workaround in place, ignore “Resolved” labels on this issue until Microsoft ships and documents a specific fix, and test that fix on a pilot group before rolling it out. For organisations already questioning how much they rely on a single VPN tunnel, our explainer on VPN vs zero trust is worth a read.

We’ll update this article when Microsoft releases the fix.