## TL;DR
The device tunnel must come up before any user signs in, so check the machine certificate and the pre-logon profile first. Verify the device tunnel VPN profile is deployed, the machine certificate is valid, and the VPN provider is registered for pre-logon. Test with a reboot and watch for the tunnel at the logon screen.

## Steps
1. Confirm the device tunnel profile is deployed to the machine via Intune or group policy.
   Expected: The profile appears in the VPN settings as a device tunnel.
2. Verify the machine certificate used for authentication is present and not expired.
   Expected: The certificate is valid and chains to the issuing CA.
3. Check that the VPN provider supports pre-logon and is enabled for the device tunnel.
   Expected: The provider shows registered for pre-logon access.
4. Reboot and watch the network icon at the logon screen for the tunnel state.
   Expected: The tunnel connects before sign-in and domain logon works.

## When to use
- Remote machines cannot reach the domain at first logon
- Password changes fail for remote users at the logon screen
- The user tunnel works fine but the device tunnel never appears

## When not to use
- The tunnel connects but drops after logon (stability issue instead)
- The machine has no device tunnel profile deployed (deploy one first)
- User-tunnel VPN is the design (device tunnel is a separate feature)

## Why this happens
The device tunnel authenticates as the machine, not the user, using a machine certificate at the logon screen. If the certificate expired, the profile targets the wrong gateway, or pre-logon is disabled, the tunnel silently never starts and everything domain-related fails at logon.

## Edge cases
- Machine certificates auto-renew only if the template allows it; expired machine certs are the top silent killer.
- Some VPN clients need an explicit pre-logon provider install separate from the main client.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_BicLKtmGPkFQckkJR5zLuA