Windows 11 Security Update KB5124008 Breaks Always-On VPN Connections
Brief
Microsoft’s September 2026 security update KB5124008 is knocking some Windows 11 enterprise clients off Always On VPN after the Patch Tuesday package landed on September 8.
Administrators who can reproduce the failure say certificate-based tunnels that worked immediately before the patch stop connecting afterward, then recover as soon as the cumulative update is removed and the device is rebooted.
The first detailed account appeared on Microsoft Q&A on September 9, 2026, from an administrator running Windows 11 24H2 and 25H2 clients with Always On VPN, certificate-based authentication, Routing and Remote Access Service plus Network Policy Server on Windows Server 2019, and a VPN profile deployed through Microsoft Intune.
Windows 11 Security Update KB5124008
After KB5124008 is installed, Always On VPN no longer connects.