Windows 11 Dropping Wi-Fi on Boot? Blame Your VPN Kill Switch

Windows 11 users have been experiencing unexpected Wi-Fi disconnections shortly after booting their devices. This issue occurs when a VPN with a strict kill switch is enabled. The problem is not hardware-related but rather a race condition between Windows 11's network connection heuristics and the VPN's low-level packet filter. The root cause lies in the interaction between three components: the VPN Kill Switch, Network Connectivity Status Indicator (NCSI), and Windows Connection Manager (WcmSvc).

Modern VPN clients bypass the traditional user interface and install kernel-level filters into the Windows Filtering Platform (WFP) upon startup. When a user enables a VPN kill switch or lockdown mode, these WFP callout drivers enforce strict rules that block all traffic except for traffic routed through the VPN tunnel.

Upon boot, Windows attempts to establish an internet connection through NCSI by sending DNS and HTTP probes. However, if the VPN tunnel has not yet established, the WFP kill switch blocks these probes. Consequently, Windows tags the Wi-Fi connection as having limited or no connectivity. The Windows Connection Manager then intervenes, perceiving the link as defective and forcibly disconnecting the Wi-Fi adapter to attempt a recovery.

To resolve this issue, users can disable the Bad State Tracking feature within Windows Connection Manager. This modification prevents Windows from automatically disconnecting Wi-Fi connections based on the health evaluation results, thereby maintaining a stable network connection even when a VPN with a kill switch is active.