Always On VPN Updates for Windows 10 2004

Always On VPN Updates for Windows 10 2004Microsoft recently made available an update for Windows 10 2004 that includes many important fixes for outstanding issues with Windows 10 Always On VPN. KB4571744 (build 19041.488) addresses many challenges faced by Always On VPN administrators today, including the following.

TPM

This update addresses an issue that prevents hash signing from working correctly using the Microsoft Platform Crypto Provider for Trusted Platform Module (TPM). This issue can occur when administrators configure Always On VPN to use Protected Extensible Authentication Protocol (PEAP) with client certificate authentication using a FortiGate security device.

Sleep/Hibernate

This update also addresses issues with Windows 10 Always On VPN failing to automatically reconnect when resuming from sleep or hibernate. I’ve written about issues with Always On VPN and sleep/hibernate in the past. This is an issue that has plagued Always On VPN since its introduction, so let’s hope this finally provides some meaningful relief from this persistent problem.

Certificate Authentication

When both the Always On VPN device tunnel and user tunnel are provisioned to a Windows 10 clients, user tunnel connections may be authenticated using the machine certificate and not EAP/PEAP. This can result in connections that are not validated as intended, and allowing a user to bypass configured NPS policies, MFA requirements, or conditional access rules. This update includes a fix for this issue, restoring proper authentication for the user tunnel when the device tunnel is also provisioned.

Device and User Tunnel Coexistence

A bug that first appeared when Windows 10 2004 was introduced prevented a device tunnel and user tunnel Always On VPN connection from being established to the same VPN server if the user tunnel used Internet Key Exchange Version 2 (IKEv2). This update restores full functionality under those conditions.

Update KB4571744

To resolve these issues with Windows 10 Always On VPN as well as others, download and install update KB4571744 today. If you are experiencing any of these issues with releases of Windows 10 prior to 2004, look for updates for those build to come later this year.

Additional Information

September 3, 2020 – KB4571744 (OS Build 19041.488) Preview

Windows 10 Always On VPN Connection Issues after Sleep or Hibernate

Windows 10 Always On VPN Bug in Windows 10 2004

Leave a comment

13 Comments

  1. FLOVE

     /  September 9, 2020

    This update is still a preview and not automaticall found via regular “Check for updates” button or WSUS.

    Reply
  2. Chris A

     /  September 10, 2020

    This patch was only released for 2004 build. Does that mean all of those issues where not applicable for build 1909?
    Because I experience the IKEv2 issue (Device and User Tunnel Coexistence) issue also on build 1909.

    Reply
    • In most cases these issues are present in older releases. Microsoft typically makes them available for the latest release first, then backports them to older clients at a later date. If you are having any of these issues in 1909 or earlier, you can expect these updates in the next month or so.

      Reply
  3. Prasanth

     /  September 10, 2020

    Hi Richard
    is it possible for only Usertunnel to be configured for AlwaysOn. No Device tunnel. How secure this implementation is? The VPN server have dmz internal and dmz external leg which is controlled by firewall.
    Kindly advice

    Reply
  4. sysadminjames

     /  September 18, 2020

    Was looking through updates, this looks to resolve the waking from sleep for 1903

    https://support.microsoft.com/en-us/help/4577062

    Testing for us today.

    Reply

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

This site uses Akismet to reduce spam. Learn how your comment data is processed.

%d bloggers like this: