The Always On VPN September update for Windows 11 is breaking enterprise VPN connections, Microsoft has warned IT administrators, with affected systems either hanging in a ‘Connecting’ state or cycling through repeated failed attempts. The culprit, according to Microsoft Support, is that KB5124008 and subsequent updates enable a feature called Machine Identity Isolation, and that feature only works properly in environments running a Windows Server 2025 Domain Functional Level or above.
In a service alert shared by Microsoft MVP Susan Bradley and seen by BleepingComputer, Microsoft confirmed the issue affects customers whose systems attempt to connect to an enterprise network via Always On VPN after installing the September 2026 cumulative updates. Three Windows 11 versions are in scope: version 26H1 (KB5124012), version 25H2 (KB5124008), and version 24H2 (KB5124008).
Why the Always On VPN September update causes failures
Always On VPN is the successor to the legacy DirectAccess remote access technology. It runs in the background, automatically establishing a secure tunnel to the corporate network whenever a device goes online, and it supports domain-joined, non-domain-joined, and Microsoft Entra ID-joined devices across Windows 10, Windows 11, and Windows Server. Administrators can define which apps and services use the connection, and it supports modern protocols including IKEv2 and SSTP, as well as multi-factor authentication.
The problem is triggered specifically when VPN profiles are set to automatic protocol selection, which tries a fallback connection method if the first attempt fails. ‘This issue can occur when the VPN is configured to automatically try another connection method if the initial connection fails (for example, when using automatic protocol selection with IKEv2 and SSTP),’ Microsoft said. Affected connections either stall perpetually or throw the error: ‘The specified port is already in use.’
The Machine Identity Isolation feature introduced by the update is the underlying cause. Environments not yet running domain controllers at the Windows Server 2025 Domain Functional Level will find that their Always On VPN configurations fall outside the supported scope of this change, leaving certificate-based authentication paths effectively broken. Reports on Microsoft Q&A make the pattern clear: VPN connections with certificate-based authentication work normally before the patch, fail immediately afterwards, and recover once the update is removed, a fairly unambiguous sign that the update has altered something in the networking stack or IPsec certificate handling.
Workarounds while Microsoft prepares a permanent fix
Microsoft has not yet released a permanent resolution and says it is still working on one. In the meantime, it is recommending that IT administrators manually override the automatic protocol selection in Always On VPN profiles and commit to a single tunnelling protocol. ‘IT administrators can mitigate this issue by changing the Always On VPN profile from automatic protocol selection to a single protocol, either SSTP only or IKEv2 only, depending on their environment and configuration,’ Microsoft said. ‘Organisations should select the protocol based on their environment, security, and deployment requirements.’
A second workaround, surfaced in the Microsoft Q&A thread, involves temporarily switching affected profiles to EAP-TLS authentication via Intune, which may sidestep the broken certificate chain validation path introduced by the update. That option will suit environments already managing devices through Intune, though it requires additional configuration effort and is not an official Microsoft recommendation from the service alert itself.
Organisations that cannot immediately change their VPN profiles or pivot to EAP-TLS may find the most direct relief in simply deferring KB5124008 until a permanent fix is available, though that carries its own trade-offs given the security content included in September’s cumulative package.
A September Patch Tuesday causing wider headaches
The Always On VPN breakage is not the only fallout from this month’s updates. Microsoft issued emergency out-of-band patches to address Hyper-V failures, Remote Desktop Services breakages, and USB audio problems that also originated with the September 2026 updates. Separately, Microsoft has shared a temporary workaround for an issue blocking some Windows 11 users from logging in with valid domain credentials, and has announced it is working to resolve a bug that may cause the built-in File History backup feature to stop functioning.
Microsoft has said it will update the service alert once a permanent fix for the Always On VPN issue is ready for release.
