Microsoft patches Always On VPN failures in Windows, as users report new Wi-Fi authentication breaks

According to TechRadar, users began reporting connection failures with Always On VPN after a Windows update in September 2026. In an alert shared with IT administrators that month, Microsoft acknowledged a bug that caused Always On VPN to fail when a computer could not establish an initial internet connection. Repeated connection attempts could display an error reading "The specified port is already in use," which suggested Windows had not recognized a failed connection. The issue affected computers and servers running Windows 11 24H2 or newer.

Always On VPN is a connection standard built into Windows 10, Windows 11 and Windows Server that activates a VPN as soon as the machine detects an active internet connection. It is the underlying technology that allows some VPN clients to connect automatically on Windows computers. Machines configured to connect automatically could therefore have been left without protection against malicious tracking or data harvesting while the bug persisted, a particular concern for large organizations.

For users and organizations unable to install the cumulative updates, Microsoft described a temporary mitigation: "IT administrators can mitigate this issue by changing the Always On VPN profile from automatic protocol selection to a single protocol, either SSTP only or IKEv2 only, depending on their environment and configuration."

Some users reported a side benefit. A Reddit user posting as Canada_Ottawa said a Surfshark connection improved in both speed and stability overnight after installing the Windows 11 update released on Oct. 13, 2026, following roughly two months of instability that was especially noticeable when waking the computer from Sleep mode. TechRadar said it was unclear whether the improvement was intentional.

Other users reported new failures. Reddit user ephycalyptus said they could no longer connect to their company's Wi-Fi network, which uses Aruba access points; commenters suggested the update had affected 802.1x PEAP connections and NTLMv1 authentication protocols. A post on Microsoft Learn by user Supply-PWC described a similar problem: "After installing KB5127648, Windows 11 clients can no longer authenticate to our WPA2-Enterprise (802.1X/PEAP) wireless network. Authentication starts but never completes [...] The issue reproduces across multiple hardware vendors and wireless chipsets."

TechRadar said it would watch for further updates from Microsoft in the coming days.

Editor's Summary

Microsoft issued KB5127646 and KB5127648 to fix an Always On VPN bug that prevented automatic connections on Windows 11 24H2 and newer systems, a flaw that could leave machines running without VPN protection. While at least one user reported improved VPN speed and stability after installing the patch, others said enterprise Wi-Fi using 802.1X/PEAP and NTLMv1 authentication stopped working on multiple hardware vendors and wireless chipsets.