September Windows updates break Always On VPN connections

Microsoft has told IT administrators that users may run into Always On VPN connection problems after installing the September 2026 Windows 11 security updates.

Always On VPN is a remote access solution that replaced the legacy DirectAccess technology. It works with domain-joined, non-domain-joined, and Microsoft Entra ID–joined devices, and is available on Windows 10, Windows 11, and Windows Server. It runs quietly in the background, automatically establishing a secure tunnel back to the corporate network whenever a device goes online. Administrators can also define which apps and services are allowed to use the VPN, and the technology supports modern protocols such as IKEv2 and SSTP alongside multi-factor authentication.

What actually breaks

In a service alert seen by BleepingComputer and shared by Microsoft MVP Susan Bradley, the company says affected customers may struggle to connect to their organization's enterprise network.

According to Microsoft, the fault surfaces when the VPN is configured to fall back to another connection method if the first attempt fails — for instance, with automatic protocol selection between IKEv2 and SSTP. Connections may hang in a 'Connecting' state or keep retrying without ever succeeding. Later attempts may also throw the error: 'The specified port is already in use.'

The issue is tied to update KB5124012 for Windows 11 version 26H1, and KB5124008 for versions 25H2 and 24H2.

A temporary fix

There is no permanent fix yet, but Microsoft has offered a workaround: administrators should switch the Always On VPN profile from automatic protocol selection to a single protocol — either SSTP only or IKEv2 only, depending on the environment and its requirements.

This month's cumulative updates have been linked to a string of other problems as well. A week earlier, Microsoft shipped emergency patches for Hyper-V issues, Remote Desktop Services failures, and USB audio glitches. It also published a workaround for a separate bug that blocked some Windows 11 users from logging in with valid domain credentials, and acknowledged another flaw that can stop the built-in File History backup feature from working.

Source: Bleeping Computer