Windows 11 users relying on **Microsoft's Always On VPN** solution can breathe a sigh of relief. The tech giant has finally delivered a fix for persistent connection failures that emerged after the installation of the September 2026 security updates. ### The VPN Connectivity Saga The **Always On VPN** solution is a cornerstone for many organizations, providing secure, always-on tunnels for devices connecting to corporate networks. It's a successor to the older DirectAccess technology, supporting a range of device types including domain-joined, non-domain-joined, and **Microsoft Entra ID**-joined systems running Windows 10, Windows 11, and Windows Server. Back in September, **Microsoft** acknowledged that its security updates were causing **Always On VPN** failures on Windows 11 systems, specifically when automatic protocol selection was used with **IKEv2** and **SSTP**. > "This update fixes an issue that affects Always On VPN connections after installing September security update," **Microsoft** stated. "When automatic protocol selection or protocol fallback was configured, affected VPN connections could remain stuck in a Connecting state or fail to connect after an initial connection attempt failed. In some cases, subsequent connection attempts could display the error, 'The specified port is already in use.'" This wasn't **Microsoft's** first attempt at a fix. The company had previously, and mistakenly, indicated that the issue was resolved in the October 2026 Windows 11 cumulative updates. ### The Solution Arrives The definitive fix has now been delivered to users who installed this month's **KB5127936** preview update. This update directly addresses the underlying cause of the VPN connection problems, ensuring that automatic protocol selection functions as intended. ### Workaround for Delayed Adoption For IT administrators who prefer to defer installing preview updates and await next month's Patch Tuesday cumulative releases, **Microsoft** has also provided a temporary workaround. This involves manually configuring the **Always On VPN** profile to use a single tunneling protocol – either **SSTP** only or **IKEv2** only – rather than automatic selection. "IT administrators can mitigate this issue by changing the Always On VPN profile from automatic protocol selection to a single protocol, either SSTP only or IKEv2 only, depending on their environment and configuration," **Microsoft** advised. "Organizations should select the protocol based on their environment, security, and deployment requirements." ### Additional Fixes in the Update Beyond the VPN resolution, the October 2026 preview update also tackles another significant issue: Remote Desktop failures. It fixes a known problem preventing non-admin users from connecting to devices via Remote Desktop when the "Administrator protection" security feature is enabled, a bug introduced by the September 2026 Windows 11 non-security preview update and subsequent releases.  ## Once attackers have valid credentials, only 37% of their actions are blocked Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. [Get the report](https://hubs.li/Q04sB3fb0)