Skip to content
Windows

Microsoft September 2026 Windows Update Breaks Always On VPN Connections

The September 2026 Windows 11 update can stall Always On VPN connections when automatic protocol selection is enabled. A temporary fix forces the profile to use a single protocol while Microsoft works on a permanent solution.

Laptop displaying a security lock icon on a table with a potted plant and clock.

Businesses that rely on Always On Virtual Private Network (VPN) for remote access may see connections stall after the September 2026 Windows 11 security update (version 26H1). Microsoft has warned IT administrators that the update can leave VPN tunnels in a perpetual Connecting state or cause repeated failures, often reporting the error “The specified port is already in use”.

What’s broken?

The problem appears only when the VPN profile is set to automatic protocol selection, the client tries IKEv2 first and falls back to Secure Socket Tunnelling Protocol (SSTP) if needed. After the September roll‑out, devices using that setting may:

  • stay stuck on Connecting without ever establishing a tunnel,
  • repeatedly retry the connection, and
  • surface the “specified port is already in use” message on each attempt.

These symptoms disrupt users who depend on a seamless, always‑on link to corporate resources, especially in environments that enforce zero‑trust network access.

Why it happens

The update for Windows 11 version 26H1 introduces a change in how the networking stack handles port allocation for the automatic fallback logic. When the client switches between IKEv2 and SSTP, the port that should be released remains bound, causing the subsequent attempt to fail with the noted error. Microsoft’s own investigation confirms the issue is limited to the automatic selection mode; manually selecting a single protocol avoids the conflict.

A laptop displaying VPN software sits on a wooden desk with a notepad and plant offering a secure workspace vibe.

Photo by Kevin Paster on Pexels

Temporary workaround, force a single protocol

Until Microsoft ships a permanent fix, the recommended mitigation is to edit the Always On VPN profile and lock it to one protocol only, either SSTP or IKEv2, depending on your environment.

  1. Open the VPN profile in the Windows Settings app or via Group Policy.
  2. Locate the NativeProtocolType (or similar) setting.
  3. Change the value from Automatic to SSTP or IKEv2.
  4. Save the profile and push the change to affected devices.

This forces the client to use a single, stable protocol and prevents the port‑reuse bug. The workaround is safe for both corporate and BYOD deployments, but be aware that SSTP requires a public‑facing port (typically 443) while IKEv2 uses UDP 500/4500 and may need firewall adjustments.

Other side‑effects of the September roll‑out

The same September cumulative update introduced several unrelated regressions that IT teams should also watch for:

  • Hyper‑V host‑folder shares may become unavailable on Linux virtual machines, breaking file‑based workflows.
  • Remote Desktop Services (RDS) experienced outages, preventing users from connecting to Windows Server sessions.
  • USB audio devices stopped working on some PCs, affecting call‑centre and conference‑room setups.
  • A separate bug blocked a subset of Windows 11 users from logging in with valid domain credentials, causing authentication failures.
  • The built‑in File History backup feature could stop working, risking loss of user‑level versioned data.
Individual using a VPN application on a laptop at a desk in a modern office setting.

Photo by Dan Nelson on Pexels

Each of these issues has its own emergency update from Microsoft, but they share the same September release window, so coordinate testing and deployment carefully.

What to do now

  • Audit VPN profiles: Identify any that use automatic protocol selection and apply the single‑protocol change.
  • Monitor update status: Keep an eye on Microsoft’s release notes for the forthcoming permanent fix; the timeline is not yet public.
  • Validate related fixes: Apply the emergency patches for Hyper‑V, RDS, USB audio, domain login, and File History as soon as they are available.
  • Communicate with users: Let remote workers know the issue, the temporary fix, and any expected downtime for related services.
  • Document the change: Record the protocol‑selection adjustment in your change‑management system to avoid surprise during future audits.

By acting quickly, you can minimise disruption while Microsoft finalises a lasting solution.

Terms used in this article

  • Always On VPN, a Windows feature that automatically establishes a VPN tunnel when the device starts.
  • IKEv2, Internet Key Exchange version 2, a VPN protocol that uses IPsec for encryption.
  • SSTP, Secure Socket Tunnelling Protocol, a VPN protocol that runs over HTTPS (port 443).
  • Hyper‑V, Microsoft’s virtualization platform for running virtual machines.
  • Remote Desktop Services (RDS), a server role that lets users access Windows desktops remotely.
  • File History, a Windows backup utility that saves copies of personal files.

Read next