## Error message
```text
Error 691: The remote connection was denied because the user name and password combination you provided is not recognized, or the selected authentication protocol is not permitted on the remote access server.
```

## TL;DR
The server did not recognize the credentials or refused the protocol offered. Re-enter the credentials carefully, set the VPN type and authentication protocol to match the server (usually automatic with MS-CHAPv2), and confirm the user's dial-in permission in Active Directory.

## Steps
1. Re-enter the username and password, watching for caps lock and domain prefix format.
   Expected: You rule out typos.
2. Open the VPN connection properties and set VPN type to Automatic and allowed protocols to match the server.
   Expected: The settings match the server's expected configuration.
3. In Active Directory, check the user's Dial-in tab for the network access permission.
   Expected: The permission is set to allow or controlled by NPS policy as expected.
4. Reconnect the VPN.
   Expected: The connection establishes.

## When to use
- The exact error 691 appears on a Windows built-in VPN client
- The failure follows a password change
- The user connects from a personal device with manual settings

## When not to use
- The VPN uses certificates or machine auth (different failure modes)
- The error is 812 or 809 (policy or NAT issues instead)
- The server is unreachable (connectivity first)

## Why this happens
Error 691 is the server's authentication refusal: bad credentials, a protocol the server forbids, or a dial-in permission set to deny. Password changes are the top trigger because saved VPN credentials go stale silently.

## Edge cases
- NPS network policies can deny based on time of day or group, which looks identical to a bad password.
- The domain prefix format matters: [domain]\[user] versus [user]@[domain] can behave differently.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_WtUPt_IeZh66TxSpTQJSAQ