Microsoft has fixed the Always On VPN connection failures that the September 2026 security updates caused on Windows 11, according to the release notes of the KB5127936 preview update.
The fix is available now on devices that install the optional October preview update for Windows 11 25H2 and 26H2. Devices that skip it stay affected until next month's Patch Tuesday cumulative updates.
The confirmation follows an earlier misstep. Microsoft had marked the issue as resolved in the October 2026 cumulative updates, then reopened the Always On VPN bug when it turned out the problem was still there.
Always On VPN Fix in KB5127936 and Affected Configurations
Microsoft first acknowledged the problem in a service alert sent to IT administrators in late September. According to that alert, the failures hit Windows 11 systems after the September security updates when Always On VPN profiles used automatic protocol selection with IKEv2 and SSTP.
The KB5127936 release notes describe the symptoms in more detail. "When automatic protocol selection or protocol fallback was configured, affected VPN connections could remain stuck in a Connecting state or fail to connect after an initial connection attempt failed," Microsoft says. In some cases, later connection attempts displayed the error "The specified port is already in use."
Always On VPN runs in the background and establishes secure tunnels back to a corporate network whenever a device connects to the internet. The remote access solution replaced the legacy DirectAccess technology and supports domain-joined, non-domain-joined, and Microsoft Entra ID joined devices running Windows 10, Windows 11, and Windows Server.
How Administrators Can Apply the Fix or Mitigate the Issue
Organizations have two paths. They can deploy the preview update now, or they can apply the temporary mitigation Microsoft published and wait for the November cumulative update.
- Install KB5127936 on affected Windows 11 25H2 and 26H2 devices through Windows Update or the organization's update management tool.
- If the preview update is not an option, open the Always On VPN profile and change it from automatic protocol selection to a single protocol.
- Pick SSTP only or IKEv2 only. Microsoft says organizations should select the protocol based on their environment, security, and deployment requirements.
The mitigation removes the protocol fallback that automatic selection provides, so admins who choose it should revert the profile once the fixed cumulative update is installed.
KB5127936 also resolves a separate known issue. Non-admin users could not connect to devices through Remote Desktop when the Administrator protection security feature was enabled after the September 2026 non-security preview update or later Windows updates.
Microsoft has not said whether the November Patch Tuesday release will include further changes to the VPN fix beyond what ships in KB5127936.
Thank you for being a Ghacks reader. The post Microsoft Fixes Windows 11 Always On VPN Failures From September Updates in KB5127936 appeared first on gHacks.
0 Commentaires