iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Windows Always On VPN is a built-in Windows capability that automatically connects a configured VPN profile when events such as user sign-in, a network change, or the device screen turning on occur. Windows keeps trying to restore the connection after transient interruptions. It is an enterprise access design built from Windows VPN profiles, a VPN gateway, authentication services and routing policy—not a separate consumer VPN application.
Administrators create the profile with ProfileXML through the VPNv2 configuration service provider (CSP), then deploy it with Intune, Configuration Manager, PowerShell, Windows Configuration Designer or another mobile-device-management (MDM) system. A profile can provide a User Tunnel after sign-in, a Device Tunnel before sign-in, or both at the same time.
How Always On VPN works
An Always On deployment has three cooperating parts: the Windows VPN client, a profile that defines connection behavior, and an organization’s VPN gateway. The profile specifies the gateway address, tunnel protocol, authentication method, routes, DNS behavior, automatic-connection triggers and optional traffic or app filters.
- Create the profile. An administrator defines the VPN server, IKEv2 or SSTP settings, certificates or other authentication details, routes, DNS and trigger rules in ProfileXML.
- Deliver the profile. The profile is applied to Windows through the VPNv2 CSP. Intune and Configuration Manager are common choices for managed fleets; PowerShell, Windows Configuration Designer and other MDM products can also provision it.
- Evaluate triggers. Windows watches for events such as a user signing in, a network changing or the device screen turning on. Name-based triggers, app-based triggers and trusted-network detection can refine when a connection is attempted.
- Negotiate the tunnel. The Windows client contacts the configured VPN gateway and authenticates either the user or the computer, depending on the tunnel type.
- Apply policy. Routes determine which destinations use the VPN. Split tunneling sends only selected networks through it; force tunneling sends all traffic according to the VPN routing policy. DNS rules, name triggers and app or traffic filters further restrict access.
- Recover connectivity. When Wi-Fi changes, a laptop wakes or a short outage occurs, Windows and the gateway maintain the session where possible and attempt to reconnect when the tunnel drops.
The result is a connection that behaves as part of Windows networking. Users do not need to open a separate VPN application or remember to connect each time they move between networks.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application: attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Economical &Reusable: Built durable materials with a long-lasting battery,our CAGIWIRU air duster it's a sustainable alternative to disposable air cans.
User Tunnel and Device Tunnel compared
The two Always On modes solve different operational problems. They can operate independently or concurrently on the same computer.
| Characteristic | User Tunnel | Device Tunnel |
|---|---|---|
| When it connects | After a user signs in | Before a user signs in |
| Primary purpose | Access to organizational resources for the signed-in user | Pre-login connectivity, device management and machine-level access |
| Supported protocols | IKEv2 or SSTP | IKEv2 only; no SSTP fallback |
| Authentication | User authentication defined by the profile | Machine/computer certificate |
| Supported device scope | Domain-joined, workgroup and Microsoft Entra ID–joined devices | Domain-joined Windows Enterprise or Education devices in documented versions |
| Pre-login management traffic | Unavailable until the user tunnel can start after sign-in | Available for selected management systems before sign-in |
| Concurrent operation | Can run alone or alongside a Device Tunnel | Can run alone or alongside a User Tunnel |
User Tunnel: access for a signed-in person
A User Tunnel authenticates the person who has logged on. It is suitable for file shares, intranet sites, line-of-business applications and other resources that should be available in the user’s security context. It supports both IKEv2 and SSTP, so an administrator can select the protocol and gateway compatibility appropriate for the environment.
User Tunnel is the more flexible option for mixed fleets: Microsoft documents support for domain-joined, workgroup and Microsoft Entra ID–joined devices. That makes it usable for enterprise-owned computers and many bring-your-own-device scenarios, provided the organization can issue and validate the required user credentials or certificates.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Device Tunnel: machine connectivity before sign-in
A Device Tunnel authenticates the computer with a machine certificate and connects to specified VPN servers before anyone logs on. This lets management services reach the device during startup, at the Windows sign-in screen and when no user session exists. Typical uses include policy refresh, software deployment, remote administration and domain-related operations that must work before interactive sign-in.
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
Device Tunnel is deliberately narrower than User Tunnel. It uses IKEv2 only, requires a machine certificate and requires a trusted root certification authority configured for incoming VPN connections. Microsoft documents it for domain-joined Windows Enterprise or Education devices in supported versions. A gateway that works for a User Tunnel is not automatically compatible with Device Tunnel; certificate trust, IKEv2 capabilities and gateway policy must match the Device Tunnel profile.
What happens before Windows login
The pre-login behavior comes from Device Tunnel, not from a User Tunnel configured with an aggressive reconnect setting. During boot, Windows loads the device profile and uses the computer certificate to authenticate to the IKEv2 gateway. Once the tunnel is established, only the routes and filters defined for that profile are reachable.
- The device starts and Windows loads the Device Tunnel profile.
- The VPN client validates the gateway and presents the computer certificate.
- The gateway checks the certificate chain, trusted root and authorization policy.
- Windows installs the profile’s routes and DNS behavior.
- Management or infrastructure traffic allowed by those routes can flow while the sign-in screen is displayed.
- After a user signs in, a separate User Tunnel may connect and provide user-scoped access.
Administrators should expose only the management destinations that genuinely need pre-login access. Microsoft notes that enabling traffic filters on a Device Tunnel profile denies inbound traffic from the corporate network to the client, so filter behavior must be tested against management and support workflows before broad rollout.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Protocols and authentication
IKEv2
IKEv2 is required for Device Tunnel and is also available for User Tunnel. It provides the negotiation and encryption framework between Windows and the VPN gateway. Device Tunnel deployments depend on an IKEv2 gateway that supports computer-certificate authentication and the organization’s certificate chain.
Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
SSTP
SSTP is available for User Tunnel profiles. It is not a fallback for Device Tunnel. If a design requires pre-login connectivity, selecting SSTP alone will not meet that requirement; the Device Tunnel must use IKEv2.
Certificates, RADIUS and gateway trust
A Device Tunnel uses a machine certificate. The certificate must chain to a root certification authority trusted for incoming VPN connections, and the gateway must authorize that machine identity. User Tunnel authentication depends on the profile and can integrate with enterprise authentication services, including RADIUS-based authorization. Windows Always On can also work with third-party IKEv2 gateways, but the vendor’s supported authentication, certificate and traffic-policy combinations must be checked.
Routing, DNS and traffic controls
Split tunnel versus force tunnel
In a split-tunnel design, only configured organizational routes use the VPN; ordinary internet traffic continues over the local network interface. This can reduce gateway load and preserve local access to services such as video meetings. In a force-tunnel design, routing policy sends all traffic through the VPN, allowing centralized inspection and egress control but increasing bandwidth and gateway requirements.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Routes are defined in the VPNv2 profile. A route that is missing from a split-tunnel profile makes the corresponding resource appear unreachable even though the VPN icon shows connected. Conversely, an overly broad route can send traffic to systems that were not intended to traverse the gateway.
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
DNS and name-based triggers
DNS settings determine how internal names resolve while the tunnel is active. Name-based triggers can start the VPN when Windows attempts to reach specified corporate namespaces. Trusted-network detection can prevent an unnecessary tunnel when the device is already on an approved internal network. These controls are useful for roaming laptops, but administrators must define internal namespaces and trusted networks precisely to avoid connection loops or unexpected bypasses.
App and traffic filters
App-based and traffic-based filters limit which applications, addresses or protocols can use a profile. They are useful for per-app VPN scenarios and for restricting a Device Tunnel to management traffic. Filters change reachability, not just routing: a destination may resolve correctly yet still be blocked by the profile’s policy. Document every allowed management endpoint before enabling restrictive filters.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How organizations deploy an Always On profile
Deployment is a configuration exercise rather than a user installation. The following sequence applies whether the delivery system is Intune, Configuration Manager, PowerShell, Windows Configuration Designer or another MDM.
- Choose the tunnel model. Decide whether the requirement is user access, pre-login management, or both. Confirm that Device Tunnel’s domain-join, edition, certificate and IKEv2 constraints are acceptable.
- Prepare identity and trust. Issue user credentials or certificates for User Tunnel. For Device Tunnel, enroll a machine certificate and deploy the trusted root certification authority needed by the gateway.
- Prepare the gateway. Configure the VPN server address, IKEv2 or SSTP listener, authorization rules, certificate validation and address pools. Verify compatibility with the Windows profile, especially for Device Tunnel.
- Build ProfileXML. Define the VPNv2 CSP profile with server address, protocol, authentication, routes, DNS, automatic triggers and any app or traffic filters. Keep User Tunnel and Device Tunnel profiles distinct so each has an unambiguous scope.
- Assign the profile. Use a pilot device group first. Intune or Configuration Manager is generally easier to manage at scale because assignment, reporting and rollback are centralized.
- Test each network state. Test at the sign-in screen, after sign-in, across Wi-Fi changes, after sleep and wake, on an untrusted network and on the organization’s trusted network. Verify both successful access and intentional blocks.
- Expand gradually. Review gateway logs, certificate failures, DNS results and route tables from the pilot before assigning the profile to the wider device population.
ProfileXML is the source of truth for the connection. A profile that appears in Windows but has the wrong route, certificate selector or trigger can look like a client failure when the actual problem is policy definition.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
Edition, joining and lifecycle requirements
Microsoft documents Windows VPN capability for Pro, Enterprise, Pro Education/SE and Education editions. Device Tunnel has the narrower requirements described earlier: a supported Windows Enterprise or Education edition, domain join, machine-certificate authentication and IKEv2. User Tunnel can cover domain-joined, workgroup and Microsoft Entra ID–joined devices.
For Azure point-to-site deployments, Microsoft’s current guidance recommends Windows 11. Windows 10 reached end of support in October 2025, so organizations planning a new deployment should treat Windows 11 as the supported baseline unless a specific Microsoft or gateway document states otherwise. The Windows VPN technical guide was updated on January 27, 2025; always check the requirements for the exact Windows release and gateway version being deployed.
Troubleshooting an Always On connection
The tunnel never starts
- Confirm the profile was delivered through the VPNv2 CSP and is assigned to the device or user.
- Check that the trigger matches the event being tested: sign-in for User Tunnel, or startup and pre-login operation for Device Tunnel.
- Verify the gateway name resolves and is reachable from the current network.
Device Tunnel fails authentication
- Check that a machine certificate exists, is not expired and has the required private key.
- Verify the certificate chain reaches the trusted root certification authority configured for incoming VPN connections.
- Confirm the gateway authorizes the computer certificate and supports the selected IKEv2 configuration.
The VPN connects but an internal service is unreachable
- Inspect the profile’s route entries and determine whether the destination is supposed to use split or force tunneling.
- Test internal DNS resolution and confirm the DNS policy applies while the tunnel is active.
- Review app and traffic filters for an intentional block, particularly on Device Tunnel.
The connection drops when changing networks
- Test the reconnect trigger after Wi-Fi, wired and mobile-hotspot transitions.
- Check whether trusted-network detection is classifying the current network incorrectly.
- Review gateway and Windows VPN logs for negotiation timeouts, certificate errors or address-pool exhaustion.
Security and design decisions
Always On improves consistency, but it does not decide which resources a user or device should reach. That remains the administrator’s responsibility through authentication, routes, DNS and filters. Use Device Tunnel for the smallest set of pre-login management destinations, and use User Tunnel for resources that require a person’s identity.
Free tools Windows power users keep installed
One-click scans. No signup required.
Choose split tunneling when local internet performance and gateway capacity matter and the security policy permits direct internet access. Choose force tunneling when centralized inspection or egress control is mandatory. In both cases, document exceptions such as trusted networks, name triggers and per-app rules so help-desk staff can explain why a resource is or is not using the VPN.
Bottom line
Windows Always On VPN is automatic connection and reconnection behavior built into Windows VPN profiles. User Tunnel starts after sign-in and supports IKEv2 or SSTP; Device Tunnel starts before sign-in, uses IKEv2 with a machine certificate and provides carefully scoped machine connectivity for management. ProfileXML and the VPNv2 CSP define the behavior, while Intune, Configuration Manager, PowerShell or another MDM delivers it. Correct certificate trust, gateway compatibility, routes, DNS and filters determine whether the design is secure and usable.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
