vpn error 691 "the remote connection was denied"

Error message

Error 691: The remote connection was denied because the user name and password combination you provided is not recognized, or the selected authentication protocol is not permitted on the remote access server.

TL;DR

The server did not recognize the credentials or refused the protocol offered. Re-enter the credentials carefully, set the VPN type and authentication protocol to match the server (usually automatic with MS-CHAPv2), and confirm the user's dial-in permission in Active Directory.

Steps

1. Re-enter the username and password, watching for caps lock and domain prefix format. Expected: You rule out typos.

2. Open the VPN connection properties and set VPN type to Automatic and allowed protocols to match the server. Expected: The settings match the server's expected configuration.

3. In Active Directory, check the user's Dial-in tab for the network access permission. Expected: The permission is set to allow or controlled by NPS policy as expected.

4. Reconnect the VPN. Expected: The connection establishes.

When to use

• The exact error 691 appears on a Windows built-in VPN client
• The failure follows a password change
• The user connects from a personal device with manual settings

When not to use

• The VPN uses certificates or machine auth (different failure modes)
• The error is 812 or 809 (policy or NAT issues instead)
• The server is unreachable (connectivity first)

Why this happens

Error 691 is the server's authentication refusal: bad credentials, a protocol the server forbids, or a dial-in permission set to deny. Password changes are the top trigger because saved VPN credentials go stale silently.

Edge cases

• NPS network policies can deny based on time of day or group, which looks identical to a bad password.
• The domain prefix format matters: [domain]\[user] versus [user]@[domain] can behave differently.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstWtUPtIeZh66TxSpTQJSAQ