always-on vpn device tunnel not connecting at the windows logon screen

TL;DR

The device tunnel must come up before any user signs in, so check the machine certificate and the pre-logon profile first. Verify the device tunnel VPN profile is deployed, the machine certificate is valid, and the VPN provider is registered for pre-logon. Test with a reboot and watch for the tunnel at the logon screen.

Steps

1. Confirm the device tunnel profile is deployed to the machine via Intune or group policy. Expected: The profile appears in the VPN settings as a device tunnel.

2. Verify the machine certificate used for authentication is present and not expired. Expected: The certificate is valid and chains to the issuing CA.

3. Check that the VPN provider supports pre-logon and is enabled for the device tunnel. Expected: The provider shows registered for pre-logon access.

4. Reboot and watch the network icon at the logon screen for the tunnel state. Expected: The tunnel connects before sign-in and domain logon works.

When to use

• Remote machines cannot reach the domain at first logon
• Password changes fail for remote users at the logon screen
• The user tunnel works fine but the device tunnel never appears

When not to use

• The tunnel connects but drops after logon (stability issue instead)
• The machine has no device tunnel profile deployed (deploy one first)
• User-tunnel VPN is the design (device tunnel is a separate feature)

Why this happens

The device tunnel authenticates as the machine, not the user, using a machine certificate at the logon screen. If the certificate expired, the profile targets the wrong gateway, or pre-logon is disabled, the tunnel silently never starts and everything domain-related fails at logon.

Edge cases

• Machine certificates auto-renew only if the template allows it; expired machine certs are the top silent killer.
• Some VPN clients need an explicit pre-logon provider install separate from the main client.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_BicLKtmGPkFQckkJR5zLuA

Resolved from the public thread: https://vectle.com/posts/pst_BicLKtmGPkFQckkJR5zLuA

Thread query: always-on vpn device tunnel not connecting at the windows logon screen

TL;DR: The device tunnel must come up before any user signs in, so check the machine certificate and the pre-logon profile first. Verify the device tunnel VPN profile is deployed, the machine certificate is valid, and the VPN provider is registered for pre-logon. Test with a reboot and watch for the tunnel at the logon screen.