Microsoft released Windows Server 2025 late last year. I’ve been doing extensive testing with the Routing and Remote Access (RRAS) role, commonly deployed to support Always On VPN client connections. I heavily use automation to deploy VPN servers in my lab and for large customer deployments, and after deploying some new Windows Server 2025 machines, I encountered the “binding handle is invalid” error message when running specific commands.
VPN Ports
By default, Windows Server RRAS enables IKEv2 for Remote Access (RAS) and SSTP for RAS and Routing. Each is provisioned with 128 ports. Often, these settings are updated because there are not enough ports to support expected concurrent connections. Also, SSTP should not be enabled for Routing as it is not required, and PPPoE is enabled for Routing, which is also not required. The best practice is to disable any protocols and services that are not being used.
Although updating these settings can be updated in the GUI (rrasmgmt.msc), automating these changes requires command line configuration.
Netsh
Here’s the command to configure additional SSTP ports and disable Routing using netsh.exe.
netsh.exe ras set wanports device = “WAN Miniport (SSTP)” rasinonly = enabled ddinout = disabled ddoutonly = disabled maxports = 500
However, running this command returns the following error message.
“The binding handle is invalid.”
PowerShell
You might be wondering why we don’t use PowerShell for these tasks. Sadly, not all these settings are exposed via PowerShell. For example, with the native Set-VpnServerConfiguration PowerShell command, you can set the number of ports for IKEv2, SSTP, L2TP, and GRE. However, you cannot turn these protocols on or off entirely as you can with netsh.exe commands.
Here’s an example of setting up VPN server port configuration using PowerShell.
Set-VpnServerConfiguration -SstpPorts 500 -Ikev2Ports 500 -PassThru
Note: You must restart the server (not just the RemoteAccess service) when increasing the number of ports beyond the default setting of 128.
Set-VpnServerConfiguration does not support configuration for PPTP. However, PPTP is disabled by default on Windows Server 2025.
Backup and Restore
This issue will also impede the ability to back and restore the RRAS configuration using netsh.exe. You can back up the RRAS configuration by running the following command.
netsh.exe ras dump | Out-File rasconfig.txt -Encoding ascii
You can restore the configuration by running the following command.
netsh.exe exec .\rasconfig.txt
However, you will receive “binding handle is invalid” error when running this command.
AovpnTools
Be advised that the following functions in my AovpnTools PowerShell module use netsh.exe commands that will return the “binding handle is invalid” error message when configuring Windows Server 2025 servers.
Workaround
Until Microsoft resolves this issue, administrators must use a combination of the native PowerShell commands and manual configuration using the Routing and Remote Access management console (rrasmgmt.msc) to implement these settings changes. When backing up and restoring the RRAS configuration, additional configuration will be required after configuration import to ensure the VPN server port configuration is configured correctly.
Additional Information
Always On VPN PowerShell Module on GitHub
