As reported by BleepingComputer, Microsoft has walked back its claim that October 2026 Patch Tuesday updates resolved a persistent Always On VPN connection failure affecting Windows 11 24H2 and later systems. The issue—originally introduced by September 2026 security updates—was mistakenly marked as "Resolved" on October 13 before being downgraded back to "Mitigated." A permanent fix is now expected "in the coming weeks."
Why This Matters Beyond the Headline
This isn't just a patch quality problem—it's a trust and operational continuity problem. Always On VPN is the backbone of remote access for many enterprises that migrated away from the deprecated DirectAccess technology. When the automatic protocol selection feature fails and connections hang or throw "port already in use" errors, help desks get flooded, productivity stalls, and in some environments, security posture degrades if users fall back to unsecured networks or shadow IT solutions.
The broader pattern is more concerning. September 2026 updates already triggered emergency out-of-band fixes for Hyper-V, Remote Desktop Services, USB audio, and domain credential login failures. Now October's attempt to clean up the VPN regression has itself produced a false resolution flag. For IT teams operating under tight maintenance windows and compliance deadlines, these cascading issues erode confidence in Microsoft's release pipeline at a time when predictability is critical.
Who Is Most Affected
The Workaround: Immediate Mitigation
Microsoft's guidance: switch the Always On VPN profile from automatic protocol selection to a single protocol—either SSTP only or IKEv2 only—based on your environment, security, and deployment requirements.
This is a functional but imperfect fix. IKEv2-only configurations may fail behind certain NAT or restrictive firewalls where SSTP (which tunnels over TCP 443) provides better connectivity. Conversely, SSTP-only sacrifices IKEv2's performance advantages for UDP-based traffic. Security teams should evaluate which protocol aligns with their existing perimeter controls and traffic inspection requirements before committing to a change.
Shield53 Recommendations
- Audit your VPN profiles now: Identify any Always On VPN configurations using automatic protocol selection on Windows 11 24H2+ devices. Prioritize those with the highest user counts.
- Deploy the single-protocol workaround via Intune or Group Policy before the next wave of user complaints. Document the rationale for protocol choice for future rollback.
- Monitor help desk metrics: Watch for spikes in "port already in use" errors or stuck "Connecting" states as early indicators of affected systems.
- Test October updates in a pilot ring before broad deployment. Given September's track record, treat every cumulative update as potentially carrying regressions.
- Prepare a rollback plan: Ensure you can quickly uninstall problematic KBs if new issues surface. Maintain a communications template for end users explaining VPN disruptions.
- Track Microsoft's Known Issue Rollup (KIR) and service alerts for the expected permanent fix. Schedule deployment as soon as it ships—this bug has already persisted for nearly two months.
Microsoft's apology is appropriate, but "we'll fix it later" is a tough message for enterprises that built their remote access strategy around Always On VPN specifically because Microsoft deprecated DirectAccess. Until Microsoft stabilizes its release pipeline, IT teams should assume every Patch Tuesday carries regression risk and plan accordingly.
