Windows 11 Always On VPN stuck on Connecting after September updates: KB5127936 fix

This article covers that Always On VPN issue, the status timeline reported around mid-October 2026, the KB5127936 fix path for Windows 11 25H2 and 26H2, and the IT single-protocol mitigation. It does not rehash other TricknFix pieces already published from the same preview (Smart App Control grayed out, File Explorer customizable context menu, Cloud rebuild, restore summary).

No hands-on VPN lab test is claimed here. Facts follow Microsoft’s KB notes and clearly attributed secondary reporting, consulted on 6 November 2026 (Europe/Paris). On a managed PC, ask your IT team before changing VPN profiles or installing optional updates — and do not uninstall security updates to “fix” connectivity.

According to the Always On VPN item under normal rollout on KB5127936:

Always On VPN is an enterprise-oriented VPN model (often used with domain-joined, non-domain-joined, or Microsoft Entra ID–joined devices). Home users without Always On VPN profiles are outside this specific symptom set.

As of 21 October 2026, BleepingComputer (Sergiu Gatlan) reported that Microsoft had mistakenly updated a service disclosure for this VPN issue to Resolved on 13 October 2026, then returned its status to Mitigated. The same reporting said a resolution was planned in an update in the coming weeks, and paraphrased Microsoft’s mitigation for IT: change the Always On VPN profile from automatic protocol selection to a single protocol — SSTP only or IKEv2 only, depending on the environment.

Treat that Oct 13 → Mitigated chronology as secondary reporting of Microsoft’s service-alert language. This article does not invent Microsoft alert IDs beyond what that page states. Prefer the live KB5127936 text for the fix description.

On Windows release health for Windows 11, version 25H2 (consulted the same day), a dedicated Always On VPN known-issues row was not found; other issues such as USB audio (still Mitigated) are out of scope here. Remote Desktop error 0xC000000D appears there as Resolved KB5127936 and is covered separately as a community discussion topic, not as this article’s main angle.

The KB5127936 preview page (dated 28 October 2026) lists:

How Microsoft documents obtaining the optional preview: open Start > Settings > Windows Update > Advanced options > Optional updates, then check for available optional updates.

Important scope note from the same KB: starting with the October 2026 release, non-security preview updates are available only for Windows 11 versions 25H2 and 26H2. Windows 11 version 24H2 no longer receives those non-security preview updates (Enterprise and Education continue monthly security updates). Organizations still on 24H2 should follow their IT update channel rather than expect this non-security preview package.

If your device already has KB5127936 or a later update that includes the same Always On VPN fix, Microsoft’s KB framing treats the issue as addressed for that package — prefer the official update path over staying on a long-term workaround when IT allows it.

Until a fixed update is installed (or if your channel does not yet offer KB5127936), attributed reporting of Microsoft’s mitigation says IT administrators can change the Always On VPN profile from automatic protocol selection to a single protocol:

Choose based on the organization’s environment, security, and deployment requirements. This is an IT-managed change — end users on corporate laptops should not rewrite VPN profiles on their own. Do not strip September (or later) security updates as a DIY “fix.”

KB5127936 is a large preview. Separate TricknFix articles already cover other features from that package; they are different intents: