Windows Always On VPN is a built-in Windows capability that automatically connects an organization’s configured VPN profile when defined events occur and keeps trying to restore the tunnel after network changes, sign-in, or screen-on events. It is not a separate consumer VPN service: an administrator creates a Windows VPN profile, deploys it to managed devices, and connects it to the organization’s VPN gateway.
There are two tunnel types. A User Tunnel starts after sign-in for user access to company resources. A Device Tunnel starts before sign-in, authenticates the computer with a certificate, and provides a path for device management and other machine-level traffic.
As an Amazon Associate I earn from qualifying purchases.
What Windows Always On VPN actually is
Always On is automatic connection behavior built into the Windows VPN client. An administrator defines a VPN profile containing the gateway address, tunnel protocol, authentication method, routes, DNS behavior, connection triggers, and optional traffic or application filters. Windows evaluates that profile whenever relevant conditions occur and initiates or re-initiates the connection without requiring the user to open a VPN application.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesThe VPN profile still needs an organization-operated or compatible third-party gateway. Always On does not provide a VPN server, anonymity service, or consumer privacy subscription. Its purpose is controlled access to private networks, cloud services, identity systems, and management infrastructure.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Microsoft describes automatic triggers as user sign-in, network change, and device screen-on. Administrators can add more selective behavior with name-based triggers, app-based triggers, and trusted-network detection. Once connected, the client and gateway maintain the session and attempt reconnection after transient interruptions such as changing from Wi-Fi to cellular data.
How the Always On architecture works
- Create the profile. The administrator specifies the VPN server address, IKEv2 or SSTP protocol where permitted, authentication, routes, DNS settings, triggers, and optional filters in ProfileXML for the Windows VPNv2 configuration service provider (CSP).
- Deliver the profile. The profile can be deployed with Intune, Configuration Manager, PowerShell, Windows Configuration Designer, or another mobile-device-management system.
- Evaluate triggers. Windows watches for events such as a user signing in, a network changing, or a device screen turning on. Name and application rules can limit automatic connections to situations that need them, while trusted-network detection can prevent an unnecessary tunnel inside a known corporate network.
- Authenticate and negotiate. The Windows VPN client negotiates the configured tunnel with the organization’s gateway. A User Tunnel authenticates the user according to the profile. A Device Tunnel authenticates the computer, normally with a machine certificate.
- Apply traffic policy. Routing entries decide which destinations use the VPN. DNS rules, app filters, traffic filters, and name-based triggers determine what can be resolved or reached through the connection.
- Maintain connectivity. The client and gateway keep the session alive and retry when a short outage, sleep/wake transition, or network handoff breaks the tunnel.
User Tunnel and Device Tunnel compared
The two modes can operate independently or at the same time, but they solve different access problems.
| Characteristic | User Tunnel | Device Tunnel |
|---|---|---|
| Connection timing | After a user signs in | Before a user signs in |
| Primary purpose | Access to organizational resources for the signed-in user | Pre-login connectivity, device management, and machine-level access |
| Protocols | IKEv2 or SSTP | IKEv2 only; no SSTP fallback |
| Authentication | User authentication defined by the profile | Machine or computer certificate |
| Supported device scenarios | Domain-joined, workgroup, and Microsoft Entra ID–joined devices | Domain-joined Windows Enterprise or Education devices in Microsoft-documented versions |
| Routing | Routes can be configured as split tunnel or force tunnel | Routes can be restricted to selected management or machine destinations |
| Pre-login management | Unavailable until the user signs in | Available for permitted management systems before sign-in |
| Concurrent operation | Can run alongside a Device Tunnel | Can run alongside a User Tunnel |
How a Device Tunnel works before sign-in
A Device Tunnel is established with the computer’s identity rather than a person’s credentials. Before Windows presents the sign-in experience, it uses the machine certificate to authenticate to the IKEv2 gateway. That gives selected infrastructure a path to the device while no user session exists.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWhat pre-login access enables
- Applying device-management policy before a user logs on.
- Reaching selected domain, configuration, or monitoring systems that must contact the machine directly.
- Supporting sign-in workflows that require network access to organizational identity services.
Certificate and edition limits
The gateway must trust the root certification authority that issued the computer certificate, and the certificate must satisfy the gateway’s authentication policy. Device Tunnel support is narrower than User Tunnel support: Microsoft documents it for domain-joined Windows Enterprise or Education devices in specific supported versions. A workgroup or Microsoft Entra ID–joined device may support a User Tunnel without meeting Device Tunnel requirements.
Traffic-filter caution
Device Tunnel profiles can include traffic filters to expose only required management destinations. Microsoft notes that enabling traffic filters on a Device Tunnel profile denies inbound traffic from the corporate network to the client. Administrators should therefore test management, monitoring, and troubleshooting flows after applying filters.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
How a User Tunnel works after sign-in
A User Tunnel starts only after a user logs on. It is appropriate when access should follow the user’s identity, permissions, and session rather than the machine’s identity. The profile can use IKEv2 or SSTP, depending on the gateway and authentication design.
User Tunnel supports domain-joined, workgroup, and Microsoft Entra ID–joined scenarios, making it suitable for both managed enterprise computers and some bring-your-own-device deployments. The actual credentials or certificate used for the user are determined by the profile and the organization’s authentication service.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
When both tunnels are configured, the Device Tunnel can carry machine-management traffic while the User Tunnel carries user-specific traffic. Routing and filters must be designed so the two profiles do not create competing routes or expose more internal services than intended.
Requirements before deployment
Windows edition and lifecycle
Microsoft lists Windows Pro, Enterprise, Pro Education/SE, and Education as VPN-capable editions. Device Tunnel has the additional domain-join and Enterprise-or-Education restrictions described above. Check the exact Windows version against Microsoft’s current support matrix before standardizing a profile.
Windows 10 reached end of support in October 2025. Microsoft’s current Azure point-to-site guidance recommends Windows 11, but Windows 11 is not a universal requirement for every Always On design. The gateway, profile features, and device-management platform still determine what is supported in a particular deployment.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
Certificates and trust
Device Tunnel requires machine-certificate authentication and a trusted root certification authority configured for incoming VPN connections. Certificate enrollment, renewal, revocation, and private-key protection are operational prerequisites, not optional enhancements. User-certificate designs also require a trust chain that the gateway accepts.
Free tools Windows power users keep installed
One-click scans. No signup required.
Gateway compatibility
The gateway must support the selected protocol and authentication exchange. Always On supports industry-standard IKEv2, RADIUS-based authorization, and compatible third-party IKEv2 gateways. Device Tunnel compatibility is especially dependent on gateway behavior, so Microsoft advises consulting the gateway vendor and validating the exact profile.
Profile and management tooling
Profiles use the VPNv2 CSP and ProfileXML. Intune or Configuration Manager is generally preferred for larger fleets because they can target device groups, enforce configuration, report deployment state, and rotate profiles. PowerShell and Windows Configuration Designer are useful for scripted, provisioning-time, or smaller-scale deployments.
Deploying an Always On profile: a practical sequence
- Define the access boundary. List the internal names, IP ranges, management systems, and applications that must use the VPN. Decide whether a User Tunnel, Device Tunnel, or both are required.
- Choose protocol and authentication. Select IKEv2 for the tunnel where supported. Add SSTP only for User Tunnel scenarios that require it; Device Tunnel cannot fall back to SSTP. Match user or machine certificate, RADIUS, or another supported authentication method to the gateway.
- Prepare trust. Install the required root and intermediate certificates, enroll computer certificates for Device Tunnel devices, and verify that the gateway validates the complete chain.
- Write the ProfileXML. Include the server address, tunnel type, authentication, routes, DNS settings, automatic triggers, and any app, name, or traffic filters. Keep the initial route and filter set as small as practical.
- Choose split or force tunneling. Add explicit internal routes for split tunnel, or configure policy that sends all traffic through the VPN for force tunnel. Document exceptions and expected DNS behavior.
- Assign the profile. Deliver it with Intune, Configuration Manager, PowerShell, Windows Configuration Designer, or another MDM. Separate pilot devices from production assignments.
- Test both connection states. For Device Tunnel, test boot, sign-out, and the Windows sign-in screen. For User Tunnel, test sign-in, sign-out, sleep/wake, Wi-Fi changes, and a switch between networks.
- Verify gateway and endpoint logs. Confirm certificate selection, authentication result, assigned address, routes, DNS resolution, and reconnect behavior before expanding deployment.
Routing, DNS, triggers, and filters
Split tunnel versus force tunnel
| Policy | What travels through the VPN | Typical reason to use it | Main consideration |
|---|---|---|---|
| Split tunnel | Only destinations covered by VPN routes | Reach private services while ordinary internet traffic uses the local connection | Every required private network must have a correct route and DNS design |
| Force tunnel | All traffic covered by the routing policy | Centralize inspection, egress control, or enterprise security policy | Gateway capacity, latency, and internet breakout must be planned |
Routes are added through the VPNv2 CSP. A split-tunnel profile may send internal address ranges through the gateway while leaving public traffic on Wi-Fi or Ethernet. A force-tunnel profile instead directs general traffic through the organization’s path, subject to the configured exceptions.
DNS and name-based triggers
DNS settings determine whether internal names resolve through organizational servers and whether applications can locate private services. Name-based triggers can initiate or maintain the VPN when a specified namespace is requested, reducing unnecessary connections while preserving access to defined domains.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Application and traffic filters
Application filters can bind VPN use to selected programs, while traffic filters restrict permitted flows. These controls support least-privilege designs but can make troubleshooting harder if a required management or authentication endpoint is omitted. Add filters only after the unfiltered pilot profile works and its traffic is understood.
Trusted-network detection
A trusted-network rule can recognize when a device is already on an approved corporate network and avoid creating a redundant external tunnel. Test transitions carefully: a device must reconnect when it leaves that trusted network.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Does Always On VPN use IKEv2 or SSTP?
It can use either, but the choice depends on the tunnel type. User Tunnel supports IKEv2 and SSTP. Device Tunnel is IKEv2-only and has no SSTP fallback. IKEv2 is also required for the machine-certificate-based Device Tunnel design described by Microsoft.
Protocol selection is only one part of compatibility. The gateway must support the authentication method, certificate requirements, routes, and profile options used by Windows. A profile that is syntactically valid can still fail if the gateway does not accept its negotiation or trust chain.
Using Intune and other deployment methods
Intune can distribute VPNv2 CSP settings and ProfileXML to targeted Windows groups, making it practical to stage a pilot, assign a Device Tunnel to computers, and assign a User Tunnel to users or devices. Configuration Manager can perform a similar role in organizations that already manage Windows through that platform.
PowerShell and Windows Configuration Designer can provision profiles during imaging, enrollment, or scripted setup. These methods are useful when a device must receive a profile before normal MDM enrollment, but they require stronger change control because reporting and rollback are more manual.
Whichever method is used, keep certificate enrollment, VPN profile delivery, and gateway policy coordinated. Sending a profile before its certificate or trusted root is present commonly produces an authentication failure that looks like a network outage.
Troubleshooting common failures
The tunnel never starts
- Confirm the profile was delivered to the intended device or user and that the VPN service recognizes it.
- Check that the trigger applies to the current state: Device Tunnel before sign-in, User Tunnel after sign-in, and network or screen events as configured.
- Verify that the gateway address resolves and is reachable on the current network.
Device Tunnel fails at boot
- Check that the computer has a valid private-key certificate and the complete chain to a root CA trusted by the gateway.
- Confirm the device is domain joined and runs an edition and version that support Device Tunnel.
- Verify that the gateway accepts IKEv2 machine authentication; SSTP cannot rescue a Device Tunnel failure.
The VPN connects but an internal service is unreachable
- Inspect the assigned routes and determine whether the destination is covered by split-tunnel policy.
- Test internal DNS resolution separately from direct IP connectivity.
- Review app and traffic filters for an omitted service, port, or management endpoint.
Connectivity breaks when networks change
- Check the network-change trigger and reconnect behavior.
- Look for overlapping routes from a User Tunnel and Device Tunnel.
- Compare client and gateway logs around the handoff to identify certificate, authentication, or address-assignment errors.
Management stops after filters are enabled
Temporarily test with the filter removed on a pilot device, then add only the management destinations that are actually required. Remember that Microsoft documents inbound blocking from the corporate network when Device Tunnel traffic filters are enabled.
Security and operational trade-offs
- Least privilege: Narrow routes, DNS scope, app filters, and traffic filters reduce exposure but increase configuration complexity.
- Machine versus user identity: Device Tunnel gives infrastructure a computer identity before login; User Tunnel lets access follow the signed-in user.
- Certificate operations: Machine-certificate authentication avoids storing a reusable password on the device, but enrollment and renewal must be monitored.
- Availability: Automatic retries improve resilience during network changes, while force tunneling can make a gateway outage affect all internet access.
- Privacy and inspection: Split tunneling leaves non-corporate traffic on the local network; force tunneling centralizes traffic according to organizational policy.
Is Windows 11 required?
No single Windows Always On rule makes Windows 11 mandatory. Microsoft documents VPN-capable Windows editions beyond Windows 11, and User Tunnel supports several join types. However, Windows 10 reached end of support in October 2025, and Microsoft’s current Azure point-to-site guidance recommends Windows 11. For a new deployment in 2026, Windows 11 is the safer lifecycle choice; confirm the exact edition, build, profile features, and gateway combination before rollout.
Quick Recap
Key takeaways
- Always On VPN is automatic behavior for a Windows VPN profile, not a standalone consumer VPN product.
- User Tunnel connects after sign-in for user access; Device Tunnel connects before sign-in for machine and management access.
- Device Tunnel is IKEv2-only and requires a computer certificate plus a trusted root CA. User Tunnel supports IKEv2 and SSTP.
- ProfileXML and the VPNv2 CSP carry the configuration, which can be delivered through Intune, Configuration Manager, PowerShell, Windows Configuration Designer, or another MDM.
- Routes, DNS, triggers, app filters, and traffic filters determine when the tunnel connects and what it can reach.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
