Windows 11 KB5127936: fixes for Always On VPN and Remote Desktop
News date: 2026-10-28 · Sources reviewed: 2026-11-02
Remote access is a production service, not merely a convenience. Some Windows 11 environments experienced Always On VPN and Remote Desktop failures after September 2026 updates. On October 28, Microsoft released optional non-security preview update KB5127936 for Windows 11 versions 25H2 and 26H2 with fixes for both issues. Organizations with remote staff should make a measured deployment decision based on impact, testing and support readiness.
Symptoms addressed by Microsoft
The official release notes say Always On VPN connections could remain stuck at Connecting or fail following an unsuccessful first attempt when automatic protocol selection or protocol fallback was configured. Later attempts could show an error stating that the specified port was already in use. The update also addresses a Remote Desktop issue affecting non-admin users connecting to devices with Administrator protection enabled, potentially showing error 0xC000000D.
- Match the observed symptom and Windows version before changing policy.
- Do not assume that every VPN failure has this cause; certificate, DNS and gateway issues remain possible.
What KB5127936 actually is
KB5127936 is an optional non-security preview cumulative update released on October 28, 2026 for Windows 11 25H2 and 26H2. Microsoft lists OS builds 26200.9818 and 26300.9818. This is a quality preview, not an emergency security update. An IT team should decide whether restoring a broken VPN or RDP workflow justifies early deployment or whether it can follow the normal monthly testing and servicing process.
- Capture the OS version, build and update history of affected endpoints.
- Review documented known issues before approving the preview.
A practical enterprise pilot
Choose a small group representing the real access patterns: home workers, Entra-joined and domain-joined devices, different networks and RDP usage. Install the update on the pilot devices, reboot as required, and test VPN initial connection, reconnection after an Internet interruption and access to critical business applications. In Intune, use a dedicated test assignment or ring and record the outcome before expanding to the wider fleet.
- Test initial Always On VPN connection and reconnect behavior.
- Validate RDP using a non-administrator account where relevant.
- Monitor helpdesk incidents, Windows event logs and rollback readiness.
A temporary option if the preview is deferred
Microsoft describes a workaround for affected Always On VPN profiles: replace automatic protocol selection with a single protocol, either SSTP or IKEv2, chosen according to the organization’s requirements. This is a configuration change that must be tested against the VPN gateway and the security architecture. It is not a reason to disable security controls or expose additional services to the Internet.
- Confirm gateway support for the selected protocol.
- Document the change and a plan to restore the intended configuration after remediation.
Turn the incident into a repeatable process
The broader lesson is to deploy Windows updates through controlled rings, explicit acceptance tests and clear user communications. VALUE360 can support endpoint management, Intune deployment planning, Managed IT monitoring and remote-access troubleshooting. The business case for an optional preview should be a verified operational need rather than a generic promise of improvement.
If VPN or RDP is affected, test KB5127936 on a limited group before wider rollout. If no related issue exists, follow your established update governance and servicing schedule.
Explore the related VALUE360 service →