Microsoft Windows 11 Updates Disrupt Always On VPN Connections

Microsoft has notified IT administrators that the September 2026 security updates for Windows 11 may disrupt Always On VPN connections, potentially impacting enterprise remote access capabilities.

The issue affects users attempting to connect to corporate networks through Always On VPN, a remote access solution that automatically establishes secure tunnels for domain-joined or Microsoft Entra ID-joined devices. Affected systems may become stuck in a “Connecting” state or fail with an error message stating: “The specified port is already in use.”

Technical Cause and Affected Versions

Microsoft has identified that the disruption occurs when the VPN profile is configured to use automatic protocol selection. This configuration allows the system to attempt a secondary connection method, such as switching between Internet Key Exchange version 2 (IKEv2) and Secure Socket Tunneling Protocol (SSTP), if the initial connection fails.

The connectivity issues are linked to the following Windows 11 versions and updates:

• Windows 11, version 26H1: KB5124012
• Windows 11, version 25H2: KB5124008
• Windows 11, version 24H2: KB5124008

Mitigation for IT Administrators

While Microsoft is working on a permanent fix, administrators can mitigate the issue by modifying the Always On VPN profile settings. To restore reliable connectivity, organisations should change the profile from automatic protocol selection to a single, specific protocol.

Depending on the specific requirements of the deployment environment, administrators should configure the profile to use either SSTP only or IKEv2 only. This prevents the system from attempting the automatic protocol switch that triggers the connection failure.

This incident is part of a broader series of issues reported following the September 2026 cumulative updates. Microsoft has previously addressed related bugs in this update cycle involving Hyper-V, Remote Desktop Services, and the Windows File History backup feature.