How to fix VPN after Windows update
If your VPN stopped working right after a Windows update, the problem is usually caused by a driver change, a network stack reset, or a security setting that now blocks the connection.
This guide walks through the most effective fixes and explains why they work.
Why Windows updates can break VPN connections
Windows updates can modify networking components such as the WAN Miniport, TAP adapter, Wintun driver, firewall rules, and IPsec services.
In some cases, a cumulative update also changes how Windows handles certificate validation, DNS resolution, or split tunneling.
Common symptoms include:
- The VPN connects but no internet traffic passes through it
- The VPN app shows an authentication or handshake error
- The connection drops immediately after connecting
- The VPN adapter disappears from Network Connections
- Remote access works on mobile data but not on the Windows PC
Start with the fastest checks
Before changing advanced settings, confirm the basics.
Small issues after an update can look like a VPN failure even when the root cause is simple.
Restart Windows and the VPN app
A reboot reloads services, drivers, and network bindings that may not have initialized correctly after patching.
Close the VPN client completely, restart the PC, then try connecting again.
Check whether the VPN service is running
Open Services and look for your VPN service, as well as core Windows services such as IKE and AuthIP IPsec Keying Modules, IPsec Policy Agent, and Remote Access Connection Manager.
If any are stopped, set them to automatic and start them manually.
Confirm the internet connection works without the VPN
If normal browsing fails, the issue may be with the network itself rather than the VPN.
Test another website, another browser, or another network to rule out a broader connectivity problem.
Repair the network stack
Windows updates can disturb the network stack, especially if a reboot was interrupted or a driver was replaced.
Resetting key components often fixes the problem.
Reset TCP/IP and Winsock
Open Command Prompt as an administrator and run these commands:
netsh winsock resetnetsh int ip reset
Restart the computer after running them.
This can restore networking behavior that a Windows update altered.
Flush DNS cache
Run ipconfig /flushdns in an elevated Command Prompt.
If the VPN server hostname is resolving incorrectly, flushing cached records may fix the connection.
Release and renew the IP address
Use ipconfig /release followed by ipconfig /renew.
This helps when the local adapter is stuck with stale configuration from before the update.
Reinstall or roll back the VPN adapter
Many VPN clients depend on virtual adapters such as TAP, TUN, or Wintun.
If Windows updates replace or disable these drivers, the app may stop working until the adapter is repaired.
Check Device Manager
Open Device Manager and expand Network adapters.
Look for your VPN adapter or anything marked with a warning icon.
If the adapter is disabled, enable it.
If it shows an error, uninstall the device and reinstall the VPN client.
Reinstall the VPN client
Uninstall the VPN software, reboot, then install the latest version from the vendor.
This refreshes drivers, services, and configuration files that may have been affected by the update.
Roll back a problematic driver
If the VPN stopped working immediately after a Windows update that also installed a new network driver, open the adapter properties and use Roll Back Driver if the option is available.
This is especially useful for Intel, Realtek, Broadcom, and Qualcomm network adapters.
Review firewall and security software
Windows Security updates can tighten firewall behavior, and third-party antivirus tools often change their network protection rules after system updates.
That can block VPN traffic even when the app itself is fine.
Temporarily disable third-party security tools
Turn off any third-party firewall, endpoint protection, or web filter briefly to test the VPN.
If the VPN begins working, add the VPN client to the tool’s allow list instead of leaving protection disabled.
Check Windows Defender Firewall
Open firewall settings and confirm the VPN executable is allowed on private and public networks if needed.
Also verify that outbound rules are not blocking ports commonly used by your provider, such as UDP 500, UDP 4500, TCP 443, or provider-specific ports.
Review Controlled Folder Access and network protection
Some security features can interfere with VPN helpers, certificate stores, or update-related processes.
If your VPN uses a local helper app, make sure it is trusted by Windows Security.
Verify certificate and time settings
VPN authentication can fail when certificates appear invalid after an update or when the system clock is wrong.
This is common with enterprise VPNs that use certificate-based authentication, EAP, or mutual TLS.
Sync the system clock
Open Date and Time settings and make sure automatic time and time zone are enabled.
Then click to sync the clock manually.
Even a small time drift can break authentication.
Check certificate validity
If you use a corporate VPN, open certmgr.msc and confirm the client certificate is still present and not expired.
Also make sure the issuing certificate authority is trusted by Windows.
Update root certificates
Windows updates usually refresh trust stores, but in managed environments the chain can still become incomplete.
If the VPN server uses a certificate chain that recently changed, reinstalling the correct root and intermediate certificates may be necessary.
Adjust VPN protocol settings
Some updates change how Windows handles specific tunneling protocols.
Switching protocols can quickly reveal whether the issue is with the protocol or the VPN service itself.
- Try OpenVPN UDP and then OpenVPN TCP
- Switch from WireGuard to the vendor’s alternate mode if available
- Test IKEv2, L2TP/IPsec, or SSTP for compatibility issues
- Disable custom MTU values temporarily and revert to default
If your connection works on one protocol but not another, the Windows update likely affected the protocol path, NAT traversal, or a related driver.
Inspect DNS, proxy, and split tunneling
After an update, Windows may re-enable a proxy, alter DNS priority, or change how network routes are applied.
These changes can make the VPN seem broken even when the tunnel is active.
Turn off proxy settings if they are not required
Go to network proxy settings and confirm that no unexpected manual proxy or script is enabled.
A stale proxy can prevent the VPN client from reaching its server.
Test with split tunneling disabled
If your VPN app supports split tunneling, turn it off temporarily.
Misrouted traffic is a common reason the VPN connects but websites or internal services still fail.
Change DNS servers
Try trusted DNS resolvers such as Google Public DNS, Cloudflare, or your organization’s DNS if allowed.
If DNS queries fail through the VPN, websites may appear offline even though the tunnel is active.
Use System Restore or uninstall the update
If the VPN worked before a specific patch and every repair fails, the update itself may be the root cause.
In that case, roll the system back to the previous state.
Use System Restore
If restore points are enabled, revert to a point before the update.
This can undo driver and policy changes while preserving personal files.
Uninstall the latest Windows update
Open Update history, identify the most recent cumulative update, and uninstall it if needed.
After removal, restart and retest the VPN.
Keep in mind that Windows may reinstall it later unless you pause updates or use a temporary block.
Check for vendor updates and known compatibility issues
VPN providers frequently release patches after Microsoft changes networking behavior.
Always install the latest version of the VPN client, driver package, and any companion agent.
Look for these items on the vendor support site:
- Compatibility notes for Windows 10 and Windows 11
- Hotfixes for recent cumulative updates
- Driver updates for TAP, TUN, or Wintun components
- Guidance for enterprise deployments and domain-joined devices
If you manage multiple PCs, compare a working machine with a broken one.
Differences in VPN client version, adapter driver version, or policy settings often reveal the cause faster than trial and error.
When the problem is specific to work or school VPNs
Corporate VPNs often depend on Group Policy, RADIUS, NPS, PKI, and always-on device tunnels.
A Windows update can expose a configuration issue that was already present but dormant.
- Confirm the device has not fallen out of domain trust
- Check whether the VPN requires certificate re-enrollment
- Verify Intune, Microsoft Entra ID, or MDM policy delivery
- Review event logs for IKE, RasClient, or VPN profile errors
For managed environments, the relevant logs are often more useful than the VPN app interface.
Event Viewer can show authentication failures, route conflicts, and service startup issues after the update.
What to do next if the VPN still fails
If none of the above steps restores the connection, gather logs from the VPN client, check Event Viewer, and note the exact Windows build number from winver.
That information helps isolate whether the issue is a client bug, driver regression, or update-specific incompatibility.
In many cases, the fix comes down to one of four actions: repairing the adapter, resetting the network stack, updating the VPN client, or rolling back the latest Windows patch.
Working through those areas methodically is the fastest way to get back online.