Microsoft has acknowledged that an ongoing connectivity bug affecting Windows 11 Always On VPN profiles remains unresolved despite earlier claims that a fix had been deployed in recent cumulative updates. The tech giant formally revised its advisory documentation, walking back the resolution status to warn system administrators that a permanent patch is still weeks away.

First introduced following the September 2026 security updates, the flaw leaves managed devices unable to establish secure enterprise tunnels, creating persistent disruptions for remote corporate workforces. Organizations deploying Windows 11 versions 24H2, 25H2, and 26H1 must continue implementing temporary profile configurations to maintain network stability.

Microsoft Withdraws Resolution Claim for Windows 11 Always On VPN Bug

Microsoft initially listed the enterprise remote access flaw as fully resolved following the release of its October Patch Tuesday updates, including KB5127648 and KB5127646. However, after system administrators reported that client devices continued to fail during connection handshakes, Microsoft updated its release notes and removed the fix claims. In a service advisory dispatched to enterprise administrators, the company admitted the entry had been mistakenly marked as resolved on October 13 and apologized for the confusion caused.

The issue's official status on the Windows Health Dashboard has been reverted to "Mitigated" while engineers work on a genuine code repair. This reversal comes during an active period for Windows servicing, following recent emergency updates such as Microsoft Out-of-Band updates KB5134133 and KB5134134. Until a permanent hotfix arrives in an upcoming release cycle, administrative workarounds remain necessary to restore remote access reliability.

Root Cause and Affected Protocol Configurations

The failure stems from a flaw in how the Windows 11 networking stack manages dynamic protocol negotiation during remote access attempts. The bug specifically impacts Always On VPN profiles configured with automatic protocol selection or dynamic fallback capabilities, typically negotiating between Internet Key Exchange version 2 (IKEv2) and Secure Socket Tunneling Protocol (SSTP).

When an initial connection attempt stutters or drops, the client fails to switch gracefully to the secondary fallback protocol. Instead, the networking stack enters an unresolved state. Client machines frequently get stuck displaying a "Connecting" message indefinitely, while subsequent reconnect attempts throw local socket errors stating that "The specified port is already in use". Standard consumer VPN applications operating via third-party desktop clients remain unaffected, as the bug strictly targets native Windows Remote Access Service (RAS) profiles.

Impact on Corporate Networks and Remote Windows 11 Workforces

Always On VPN serves as Microsoft's primary remote connectivity technology, replacing legacy DirectAccess systems. The feature operates automatically in the background to secure connections between off-site endpoints and corporate infrastructures, regardless of whether devices are domain-joined, non-domain-joined, or integrated via Microsoft Entra ID. Because remote employees rely on these background tunnels to access internal file shares, databases, and intranet applications, the connection lockup severely limits productivity without impacting general internet browsing.

The bug has created a distinct administrative burden for IT help desks, who must address influxes of remote support tickets while managing complex enterprise client fleets. Operational challenges are further exacerbated when updates conflict with enterprise services, similar to the disruptions outlined in Microsoft's confirmation of Universal Print outages on Konica Minolta hardware.

Recommended Workarounds for Enterprise IT Administrators

Microsoft advises system administrators not to rely on installing the October cumulative updates alone to restore VPN functionality. Instead, IT teams must manually or programmatically adjust client VPN strategies across their deployment pipelines. The officially recommended mitigation requires locking affected Always On VPN profiles to a single explicit protocol rather than relying on dynamic negotiation.

  • Force Single Protocol Strategy: Modify client profile XML configurations or Intune deployment policies to enforce either SSTP-only or IKEv2-only tunneling.
  • Update Local Settings: Modify rasphone.pbk configurations to replace automatic protocol switching with a predefined tunnel type matching your gateway settings.
  • Deploy Updated Profiles: Push the modified single-protocol profile across client fleets via Endpoint Manager or Group Policy Objects to bypass the negotiation code path entirely.

Admins are urged to test their selected protocol against corporate Routing and Remote Access Service (RRAS) and Network Policy Server (NPS) infrastructures before pushing updates en masse. In parallel with network management efforts, administrators must keep client systems updated with security fixes, including emergency .NET security updates for Brotli vulnerabilities.

Microsoft confirmed that a validated, permanent resolution for the Always On VPN connection failure is currently being developed and will be released in an upcoming update in the coming weeks. Until then, maintaining single-protocol profile definitions remains the only effective method to ensure uninterrupted remote workforce connectivity.