Microsoft has confirmed that its recent attempt to fix a persistent VPN bug has failed. Despite including a supposed resolution in the October 2026 cumulative updates for Windows 11, the company admitted on 21 October 2026 that Always On VPN connections are still dropping or failing to initiate for many users. For UK SMEs relying on remote or hybrid work, this means staff may find themselves unable to access internal servers, databases, or line-of-business applications without warning. This is not a minor inconvenience; it is a direct hit to productivity that often results in a flood of support tickets on a Monday morning.
The October update and the failed fix
The issue centres on Always On VPN, a feature that automatically establishes a secure tunnel between a remote device and the corporate network. Unlike older manual VPNs that require a user to click 'Connect' and enter credentials, Always On VPN is meant to be transparent, connecting before the user even logs in to ensure that security policies and updates are applied immediately.
In early October 2026, Microsoft released a series of patches intended to address a bug where these connections would hang or fail with vague error messages. However, after reports from system administrators worldwide, Microsoft updated its health dashboard to state that the fix was incorrectly flagged as resolved. The bug remains active in Windows 11 versions, particularly affecting those who use Intune or Group Policy to manage their connection profiles.
What a forced VPN outage costs a 30-person firm
When remote access fails, the financial impact is immediate. Consider a professional services firm in Bristol with 30 staff members working from home. If an update breaks the VPN on a Tuesday morning, those 30 people are effectively locked out of the office file server and internal software.
If it takes your IT lead or an external provider four hours to identify that the October update is the culprit, test a rollback, and apply it across the fleet, you have lost 120 man-hours of productivity. At a conservative loaded cost of £45 per hour per employee, that single morning of downtime costs the business £5,400 in lost wages alone. This does not account for the reputational damage of missed client deadlines or the frustration of a staff body that simply wants their kit to work.
Who is exposed and how to check
Not every business will be hit by this, but those using a specific set of technologies are at higher risk. You are likely affected if:
- Your staff use Windows 11 Pro or Enterprise laptops.
- You use 'Always On VPN' rather than a third-party client like Cisco AnyConnect or FortiClient.
- Your devices are managed via Microsoft Intune or a local Active Directory.
To check if your devices are struggling, look for 'Event ID 801' or 'Event ID 829' in the Windows Event Viewer under the 'RemoteAccess-Client' logs. These often signal a failure to negotiate the tunnel or a timeout during the authentication phase. If your staff report that their connection status sits at 'Connecting' indefinitely, you are almost certainly dealing with this specific bug.
Practical actions ranked by priority
If your business is currently battling these connection drops, do not wait for the November patch cycle. Follow these steps in order:
- Identify the affected machines: Use your RMM (Remote Monitoring and Management) tool to pull a report of devices that installed the October 2026 cumulative update and are reporting VPN errors.
- Test the rollback: On a single test machine, uninstall the latest cumulative update to see if VPN stability returns. While we generally advise against removing security patches, if the business cannot function, a temporary rollback on specific machines may be necessary.
- Switch to manual triggers: In some cases, changing the VPN profile from 'Always On' to a manual trigger can bypass the bug, though this requires user training and decreases your security posture as the device is no longer 'always' protected by the corporate tunnel.
- Review your certificates: A pattern we see on most tenants we take on is that VPN profiles are often left as legacy configurations that have not been touched since the initial setup, meaning they lack the resilience to handle modern Windows update cycles without breaking. Ensure your IKEv2 or SSTP certificates are valid and that the root CA (Certificate Authority) is properly trusted by the client devices.
Why most businesses get update management wrong
The recurring theme with these Microsoft update issues is a lack of staged deployment. Many SMEs have their Windows Updates set to 'Automatic' for everyone at once. When Microsoft gets a fix wrong, as they have here, the entire company goes down simultaneously.
A more stable approach is the 'ring' method. We typically recommend a 'Pilot' group of 5% of your users (usually the IT-literate ones) who receive updates on day one. The rest of the company follows three to seven days later. This delay gives the global IT community time to find bugs like the October VPN failure, allowing you to pause the update for the remaining 95% of your staff before it causes a crisis.
The regulatory and security dimension
Beyond the loss of productivity, a broken VPN is a security risk. When the 'official' way to connect fails, staff often turn to 'shadow IT' to get their work done. They might start emailing sensitive documents to personal Gmail accounts or using unencrypted USB sticks to move data. This creates a massive hole in your GDPR compliance and moves data outside of the protections of your corporate backup and encryption policies.
The NCSC (National Cyber Security Centre) consistently advises that secure remote access is a pillar of modern business defence. If your VPN is unreliable, your staff will find a way around it, and that way is rarely secure. If you are aiming for Cyber Essentials certification, maintaining a secure, functional VPN for all remote administrative and user access is a core requirement.
Managed IT that stays ahead of the bugs
IT support is not just about fixing things when they break; it is about knowing which updates to hold back because they are causing havoc elsewhere. At Black Sheep Support, we use our 24/7 RMM tooling to monitor the health of every device we manage. When Microsoft admits a fix has failed, we can proactively pause that update across our client base, saving them from the downtime that others are currently enduring.
We also handle business hardware, broadband, and mobile, ensuring that the entire path from the remote worker's house to your office server is optimised for performance. We check the plumbing so you can focus on the business.
If your remote staff are complaining about connection issues or you are worried your update policy is too aggressive
and we will help you build a more resilient remote work setup.
Not ready to talk yet? Run our free IT Health Check to assess your business risk and security posture. You can do it on your own in 15 to 20 minutes, or spend 30 to 60 minutes with one of our engineers on a Teams call for a more in-depth look at your managed IT support needs.
Want this handled for you? See Managed IT support.
Based in Brighton or Hove? We are too: see IT support in Brighton.
Free, no sales call needed
Two free checks. Know where you stand.
Domain email check
Can someone send email pretending to be you? Is your real email landing in junk? Type your domain and find out in under a minute.
IT Health Check
A short set of questions that scores your security and business risk, and tells you what to fix first. 15 to 20 minutes on your own.
