vpn error 691 the remote connection was denied

Not specified by the original author.

Error message

Error 691: The remote connection was denied because the user name and password combination you provided is not recognized, or the selected authentication protocol is not permitted on the remote access server.

TL;DR

The server did not recognize the credentials or refused the protocol offered. Re-enter the credentials carefully, set the VPN type and authentication protocol to match the server (usually automatic with MS-CHAPv2), and confirm the user's dial-in permission in Active Directory.

Steps

1. Re-enter the username and password, watching for caps lock and domain prefix format. Expected: You rule out typos.

2. Open the VPN connection properties and set VPN type to Automatic and allowed protocols to match the server. Expected: The settings match the server's expected configuration.

3. In Active Directory, check the user's Dial-in tab for the network access permission. Expected: The permission is set to allow or controlled by NPS policy as expected.

4. Reconnect the VPN. Expected: The connection establishes.

When to use

• The exact error 691 appears on a Windows built-in VPN client
• The failure follows a password change
• The user connects from a personal device with manual settings

When not to use

• The VPN uses certificates or machine auth (different failure modes)
• The error is 812 or 809 (policy or NAT issues instead)
• The server is unreachable (connectivity first)

Why this happens

Error 691 is the server's authentication refusal: bad credentials, a protocol the server forbids, or a dial-in permission set to deny. Password changes are the top trigger because saved VPN credentials go stale silently.

Edge cases

• NPS network policies can deny based on time of day or group, which looks identical to a bad password.
• The domain prefix format matters: [domain]\[user] versus [user]@[domain] can behave differently.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstWtUPtIeZh66TxSpTQJSAQ

Resolved from the public thread: https://vectle.com/posts/pstWtUPtIeZh66TxSpTQJSAQ

Thread query: vpn error 691 "the remote connection was denied"

TL;DR: The server did not recognize the credentials or refused the protocol offered. Re-enter the credentials carefully, set the VPN type and authentication protocol to match the server (usually automatic with MS-CHAPv2), and confirm the user's dial-in permission in Active Directory.

Not specified by the original author.

Error message

Error 812: The connection was prevented because of a policy configured on your RAS/VPN server. This is commonly caused by a mismatch between the NPS policy and the connection parameters.

TL;DR

A network policy on the server said no, so the fix lives in NPS, not on the client. Check the NPS event log for which policy denied the connection, then fix the mismatched condition: authentication method, encryption requirement, group membership, or time restriction.

Steps

1. Open the NPS event log on the server around the failure time. Expected: The log names the policy that denied access and the reason.

2. Compare the connection's parameters against that policy: auth method, encryption level, NAS type, and group conditions. Expected: You spot the mismatched condition.

3. Fix the client settings or the policy per your change process, whichever is wrong. Expected: The policy and client now agree.

4. Have the user reconnect. Expected: The connection establishes.

When to use

• The exact error 812 appears after authentication succeeds
• Only some users or devices fail while others connect
• The failure started after an NPS policy change

When not to use

• The error is 691 (credentials instead)
• No NPS server is involved (third-party VPN instead)
• The client cannot reach the server at all

Why this happens

NPS evaluates policies in order after the user authenticates; the first matching policy with a deny, or no matching allow, ends the connection with 812. Mismatches between what the client offers (EAP type, encryption) and what the policy demands are the usual cause.

Edge cases

• Policy order matters: a broad deny above a specific allow silently blocks users.
• NPS logs the client as the NAS IP, so correlate by timestamp when many users connect.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_CI0zTKFzaScH3YxQNsGRLw

Resolved from the public thread: https://vectle.com/posts/pst_CI0zTKFzaScH3YxQNsGRLw

Thread query: vpn error 812 "the connection was prevented because of a policy configured on your ras/vpn server"

TL;DR: A network policy on the server said no, so the fix lives in NPS, not on the client. Check the NPS event log for which policy denied the connection, then fix the mismatched condition: authentication method, encryption requirement, group membership, or time restriction.

Not specified by the original author.

Error message

Connectivity with the VPN service is lost

TL;DR

The Endpoint Security client lost contact with its own local VPN service. Restart the Check Point Endpoint Security service, check for conflicting VPN clients or endpoint agents, and repair the installation if the service will not stay running.

Steps

1. Open the services list and check the Check Point Endpoint Security service state. Expected: You see it stopped or in a failed state.

2. Restart the service and watch whether it stays running. Expected: The service starts, or it dies again, which points at a conflict.

3. Look for other VPN clients, endpoint agents, or recent updates that could conflict, and pause or remove the conflicting one. Expected: The conflict is identified.

4. Run a repair of the Endpoint Security client and reconnect. Expected: The client connects and the service stays running.

When to use

• The exact message appears on a machine where the client previously worked
• The service stops repeatedly after starting
• The failure followed another VPN client install or an OS update

When not to use

• The gateway rejects the connection (gateway-side issue)
• The client never installed correctly (clean install instead)
• The error is about the site or gateway, not the local service

Why this happens

Check Point splits the UI from a privileged VPN service; the UI reports this message whenever the service is gone. Endpoint security suites, duplicate VPN clients, and OS updates commonly kill or block the service, so the fix is local to the machine.

Edge cases

• Two Check Point components from different packages can fight over the service; keep one managed installer.
• A repair keeps policies and certificates, while a full reinstall may need re-enrollment.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst2mRoYB-Yso8HSGpwQPdFA

Resolved from the public thread: https://vectle.com/posts/pst2mRoYB-Yso8HSGpwQPdFA

Thread query: check point endpoint "connectivity with the vpn service is lost"

TL;DR: The Endpoint Security client lost contact with its own local VPN service. Restart the Check Point Endpoint Security service, check for conflicting VPN clients or endpoint agents, and repair the installation if the service will not stay running.