Fix Windows 10/11 VPN Won’t Connect: Services and Profiles

Prerequisites and compatibility​

Before starting, have the following from your employer, VPN administrator, or VPN provider:

• VPN server fully qualified domain name (FQDN) or IP address
• Required VPN type: IKEv2, L2TP/IPsec, SSTP, PPTP, or Automatic
• Required sign-in method: username and password, certificate, smart card, one-time password, or EAP
• For L2TP/IPsec, the required certificate or pre-shared key, if applicable
• Your VPN account name and current password

You need an account with local administrator rights for service checks and repair commands. Keep an alternate Internet connection available, such as Ethernet or a mobile hotspot, if the VPN is your only route to work resources.

Warning — do not casually change the VPN type, authentication protocol, encryption requirement, split-tunneling setting, certificate, or L2TP/IPsec pre-shared key. These settings are security controls. Record the provider’s approved configuration first, and restore that configuration if a test change fails.

Click to expand...

Primary procedure​

1. Confirm that the Internet and VPN server name work before changing Windows​

A VPN cannot establish its outer connection until the PC already has normal Internet access.

• Disconnect the VPN if it is stuck in a connecting state.
• Open a web browser and confirm that a public website loads.
• Open Windows Terminal (Admin):
• Right-click Start.
• Select Terminal (Admin) or Windows PowerShell (Admin).
• Test name resolution, replacing vpn.example.com with the server name in the profile:
  Resolve-DnsName vpn.example.com
• Expected result: the command returns one or more IP addresses. If it reports that the name does not exist or cannot be resolved, correct the server name in the profile or use the DNS server required by the organization.

For an SSTP VPN, which normally uses TCP port 443, you can also test basic reachability:

Test-NetConnection vpn.example.com -Port 443

A successful result shows TcpTestSucceeded : True. A failed test can indicate a server, DNS, proxy, firewall, captive-portal, or Internet-path problem. Do not use this TCP test to diagnose IKEv2 or L2TP/IPsec: those protocols use IPsec/IKE traffic rather than a normal TCP 443 connection.

2. Inspect the existing VPN profile and record its configuration​

Do this before editing or removing anything.

• In the elevated Terminal window, run:
  Get-VpnConnection | Format-List Name,ServerAddress,TunnelType,AuthenticationMethod,EncryptionLevel,ConnectionStatus,SplitTunneling,DnsSuffix
• If this is a device-wide or company-deployed profile, also run:
  Get-VpnConnection -AllUserConnection | Format-List Name,ServerAddress,TunnelType,AuthenticationMethod,EncryptionLevel,ConnectionStatus,SplitTunneling,DnsSuffix
• Note the profile’s:
• Name
• ServerAddress
• TunnelType
• AuthenticationMethod
• EncryptionLevel
• Whether SplitTunneling is enabled

The output does not replace provider documentation. In particular, it may not provide all EAP, certificate, or pre-shared-key details needed to rebuild an enterprise VPN.

3. Check the Windows VPN-related services​

Windows does not need every VPN-related service running all the time. Several are normally set to Manual and start when needed. The problem is a service that is Disabled, stopped when it must run, or unable to start.

In the elevated Terminal window, run:

Get-Service RasMan,IKEEXT,PolicyAgent,BFE,SstpSvc | Format-Table Status,Name,DisplayName -AutoSize

Check the following:

• Remote Access Connection Manager (RasMan) manages dial-up and VPN connections. It must not be disabled.
• IKE and AuthIP IPsec Keying Modules (IKEEXT) is required for IKE/IPsec negotiation. It matters for IKEv2 and L2TP/IPsec.
• IPsec Policy Agent (PolicyAgent) supports IPsec policy processing. It should not be disabled.
• Base Filtering Engine (BFE) is a core Windows networking and filtering service. Do not disable it.
• Secure Socket Tunneling Protocol Service (SstpSvc) is relevant to SSTP profiles.

Next, inspect their startup configuration:

sc.exe qc RasMan
sc.exe qc IKEEXT
sc.exe qc PolicyAgent
sc.exe qc BFE
sc.exe qc SstpSvc

Look for START_TYPE. A demand/manual start is normal. If any service above reports DISABLED, restore it to demand start:

sc.exe config RasMan start= demand
sc.exe config IKEEXT start= demand
sc.exe config PolicyAgent start= demand
sc.exe config SstpSvc start= demand

Leave BFE at its existing enabled configuration unless it was explicitly disabled by a policy or damaged configuration.

Warning — do not set these services to Disabled as a “hardening” step, and do not use registry cleaners to change their service configuration. Disabling RasMan prevents built-in VPN connections. Disabling IKEEXT breaks IKE/IPsec key exchange and can prevent IKEv2 or L2TP/IPsec VPN connections. If an organization manages these services through Group Policy, Intune, or endpoint-security software, the management policy may revert local changes.

Click to expand...

Start the services needed by your profile:

Start-Service RasMan

For an IKEv2 or L2TP/IPsec profile, also run:

Start-Service IKEEXT
Start-Service PolicyAgent

For an SSTP profile, run:

Start-Service SstpSvc

Expected result: the command returns to the prompt without an error. Confirm status:

Get-Service RasMan,IKEEXT,PolicyAgent,BFE,SstpSvc | Format-Table Status,Name -AutoSize

If RasMan or another service immediately stops after you start it, proceed to the troubleshooting section instead of repeatedly forcing it to start.

4. Reconnect using the correct Windows Settings path​

Use Settings to confirm that Windows is attempting the profile you inspected.

Windows 11

• Select Start > Settings.
• Select Network & internet > VPN.
• Select the VPN profile.
• Select Connect.
• Enter credentials or complete the certificate, smart-card, or multifactor prompt if requested.

You can also select the Network, volume, and battery area on the taskbar, select VPN, then select the appropriate connection.

Windows 10

• Select Start > Settings.
• Select Network & Internet > VPN.
• Select the VPN profile.
• Select Connect.
• Enter the requested sign-in information.

Expected result: the profile changes to Connected. If Windows asks for credentials, use the current VPN credentials—not necessarily the same credentials used to sign in to Windows.

5. Correct only the profile fields your VPN provider specifies​

If the profile is present but cannot connect, compare it line by line with the provider’s approved details.

Windows 11

• Go to Settings > Network & internet > VPN.
• Select the profile.
• Select Advanced options.
• Select Edit beside the setting that needs correction.
• Select Save or Apply.

Windows 10

• Go to Settings > Network & Internet > VPN.
• Select the profile.
• Select Advanced options.
• Edit the required setting.
• Select Save.

Verify these fields first:

• VPN provider: Normally Windows (built-in) for this guide.
• Server name or address: Must exactly match the supplied FQDN or IP address.
• VPN type: Use the provider’s specified protocol. Do not assume that Automatic will work with every server or security policy.
• Type of sign-in info: Must match the server configuration.
• Username and password: Use the expected account format, such as DOMAIN\username, [email][email protected][/email], or the provider-specific username.
• Certificate: Select the certificate specified by the organization. A personal certificate with the wrong purpose, expired date, or missing private key will not authenticate.
• Proxy: Configure one only if the VPN provider specifically requires it.

Disconnect and reconnect after saving a profile change.

6. Restart Windows once if services or profile settings were repaired​

Restarting clears a stuck Remote Access session, reloads service dependencies, and ensures the VPN client reads the repaired configuration.

• Save work.
• Select Start > Power > Restart.
• After sign-in, confirm that normal Internet access works.
• Repeat the connection attempt from Settings > Network & internet/Network & Internet > VPN.

Verification of success​

A successful built-in VPN connection should show all of the following:

• The profile shows Connected in Windows VPN settings.
• The taskbar network area shows the VPN connection as connected; Windows may display a VPN shield overlay for recognized connections.
• This command shows a connected profile:
  Get-VpnConnection | Format-Table Name,ServerAddress,TunnelType,ConnectionStatus -AutoSize
• You can reach an intended VPN-only resource, such as an internal website, file share, remote desktop host, or DNS name.

If the VPN connects but internal names do not resolve, test the name directly:

Resolve-DnsName intranet.example.com

If the profile uses split tunneling, public Internet traffic may continue to use the local network while only corporate routes use the VPN. That can be expected behavior; do not change split tunneling merely because a public IP-address website does not change.

Alternate method: rebuild a damaged personal profile​

Use this only when you have the provider’s complete settings and the profile is clearly corrupted, duplicated, or incorrectly configured. It is often safer to create a new profile with a different name first, verify it, and then remove the old one.

Warning — removing a VPN profile deletes its local configuration. It may remove saved credentials and can remove enterprise-managed settings from the current user or all users. Record the server address, tunnel type, authentication method, certificate requirements, proxy settings, DNS suffix, and split-tunneling configuration before continuing. Do not remove an Intune-, Group Policy-, or company-managed Always On VPN profile without administrator approval; it may be reprovisioned or may be required for device management.

Click to expand...

• In Windows VPN settings, select Add VPN or Add a VPN connection.
• Enter the provider’s exact configuration.
• Give the new profile a test name, such as Company VPN - Test.
• Select Save.
• Connect to the new profile and verify access to an approved internal resource.
• Only after the new profile works, remove the obsolete profile:
• Select the old profile.
• Select Remove.
• Confirm the removal.

To remove a profile from an elevated PowerShell window after confirming its exact name:

Remove-VpnConnection -Name "Old VPN Profile Name" -Force

For a profile installed for all users, use:

Remove-VpnConnection -Name "Old VPN Profile Name" -AllUserConnection -Force

Rollback is straightforward: recreate the old profile from the recorded provider settings, or have the organization re-deploy its managed profile.

Troubleshooting and rollback/escalation​

The profile is missing or disappears after synchronization​

If a work VPN profile disappears, is recreated, or disconnects after an Intune or work-account sync, do not repeatedly rebuild it locally. This can indicate that the device’s managed VPN profile is being replaced by the organization’s configuration. Open Settings > Accounts > Access work or school, select the connected work account, and use the organization’s approved sync or support process. Escalate with the profile name, approximate disconnect time, and whether the issue started after sync.

Error 691 or repeated credential prompts​

Error 691 generally points to rejected authentication rather than a broken Windows service. Check:

• Username format required by the provider
• Password expiration or recent password change
• Multifactor authentication or one-time-password requirements
• Whether the account is permitted to use VPN
• Whether the selected sign-in method matches the server, especially EAP versus username/password

Do not weaken authentication settings to make the error disappear. Have the VPN administrator confirm the account and authentication policy.

Error 720: “A connection to the remote computer could not be established”​

Error 720 can occur when the WAN Miniport IP binding is not correctly enabled.

• Open Windows Terminal (Admin).
• Find the hidden adapter name:
  Get-NetAdapter -IncludeHidden | Where-Object {$_.InterfaceDescription -eq "WAN Miniport (IP)"}
• Copy the returned adapter Name.
• Inspect its bindings, replacing the placeholder:
  Get-NetAdapterBinding -Name "<interface_name>" -IncludeHidden -AllBindings
• If Remote Access IP ARP Driver (ms_wanarp) shows Enabled : False, re-enable it:
  Enable-NetAdapterBinding -Name "<interface_name>" -IncludeHidden -AllBindings -ComponentID ms_wanarp
• Restart Windows and test the VPN again.

If ms_wanarp is already enabled, do not randomly uninstall WAN Miniport adapters. Escalate the error with the RasClient event details and the VPN protocol in use.

IKEv2 or L2TP/IPsec fails before any credential prompt​

For L2TP/IPsec, failure before Windows asks for a username and password commonly means the IPsec session did not establish. Confirm:

• IKEEXT and PolicyAgent are not disabled and can start.
• The correct certificate or L2TP/IPsec pre-shared key is configured.
• The server address is correct.
• The local network, hotel Wi-Fi, hotspot, router, or firewall is not blocking IPsec/IKE traffic.

IKE/IPsec commonly needs UDP ports 500 and 4500 to pass between the client and VPN server. Do not add broad inbound firewall rules or disable Windows Firewall as a workaround. Test from a different Internet connection if possible; if the VPN works on a hotspot but not on the normal network, the network path is the likely cause.

SSTP fails but the Internet otherwise works​

Confirm the server FQDN resolves and test TCP 443:

Test-NetConnection vpn.example.com -Port 443

If TCP 443 fails, check captive portals, proxy settings, content filtering, local firewall products, and the VPN server’s certificate or availability. If the test succeeds but the VPN fails, verify the profile is set to SSTP, that SstpSvc is not disabled, and that the VPN server certificate name matches the server name used in the profile.

The VPN connects, but no internal sites, shares, or remote desktops work​

This is no longer a connection-establishment problem. Record whether the problem affects:

• DNS names only
• Specific internal subnets
• All internal resources
• Public Internet access as well

Run:

ipconfig /all
route print

Check whether the VPN adapter received an address, DNS servers, and routes expected by the organization. If IP-based access works but DNS names fail, the likely issue is DNS configuration, DNS suffix configuration, or DNS routing. If the VPN connects but neither IP addresses nor names are reachable, the VPN server may not be assigning the correct routes or address pool.

RasMan, IKEEXT, or BFE cannot start​

If a required service reports an error, record the exact service name and error message. Then run the supported Windows image and system-file repair sequence from an elevated Terminal window:

DISM /Online /Cleanup-Image /RestoreHealth
sfc /scannow

Restart Windows after both commands complete, then test the service and VPN again.

If BFE will not start, if services are repeatedly forced back to Disabled, or if the issue began after installing or removing a VPN, security, firewall, or endpoint-protection product, stop making broad networking changes. Escalate to the device administrator or security vendor with the service error, VPN type, exact connection error, time of the failure, and whether the issue reproduces on a different Internet connection.