Windows VPN guide · sources checked 2026-11-03
Windows VPN disconnect protection: LockDown vs app kill switches
Learn how Windows Always On and managed LockDown VPN differ from kill-switch controls in consumer VPN apps, and what to check when protection blocks connectivity.
Short answer: does Windows Always On block traffic when the VPN disconnects?
Not by itself, based on Microsoft's documentation. Windows Always On is an automatic connection feature for a configured VPN profile. Microsoft's separate LockDown VPN security feature is designed to allow network traffic only over the VPN interface and block outbound traffic when the VPN is unavailable. A consumer VPN app can provide its own kill switch, with behavior that depends on the app and its settings.
What is Windows LockDown VPN?
LockDown VPN is a Windows VPN profile security feature described for organization-managed configurations. Microsoft says it attempts to keep the VPN connected, prevents users from disconnecting or changing the profile, uses forced tunneling, and blocks outbound network traffic when the VPN connection is unavailable. For the built-in Windows VPN, Microsoft documents LockDown only for IKEv2. Microsoft cautions that a device using this policy cannot send or receive network traffic until the VPN is established. It is not a general switch every Windows user can enable for any VPN app.
How is Always On different from LockDown?
Always On tells a configured Windows VPN profile to connect automatically for supported triggers. Microsoft's VPNv2 documentation describes the AlwaysOn setting as automatic connection at sign-in and remaining connected until manually disconnected; its auto-trigger documentation lists triggers such as sign-in, network change, and screen-on for applicable configurations. That connection behavior alone does not mean Windows blocks all ordinary internet traffic if the tunnel is down. LockDown adds a traffic restriction in managed profiles.
How do consumer VPN app kill switches differ?
A VPN app can install or manage its own traffic-blocking rules, so its behavior is specific to that app, version, settings, and routing exceptions. For example, Proton documents a standard Windows kill switch for accidental VPN drops and an advanced mode that continues blocking internet access when the user manually disconnects. NordVPN documents separate Windows controls: an Internet Kill Switch that cuts internet access after disconnect, and an App Kill Switch that closes selected programs. These are provider descriptions, not guarantees about other apps or an independent audit of every Windows traffic path.
What should I check before relying on a Windows kill switch?
In the VPN app, read whether its control covers an accidental tunnel failure, a manual disconnect, selected applications, or all internet traffic, and whether split tunneling changes the scope. For a built-in or work VPN profile, check with the administrator whether Always On, LockDown, forced tunneling, or traffic filters are configured. Do not assume the Windows status label or a connected browser test establishes coverage for all apps, DNS, IPv6, brief transitions, or excluded routes.
How can I investigate an unexpected internet block?
First check whether the VPN is connected and whether a managed LockDown profile or an app's persistent kill switch is active. Reconnect to the intended VPN, review its current recovery instructions, and check for split-tunnel exceptions. If the device belongs to work or school, stop before changing a profile or policy and contact its administrator. For a personal app, use that provider's documented steps to turn off its persistent block only if you intentionally want to use the ordinary connection; this changes the traffic path.
Can a browser IP check prove the Windows kill switch works?
No. A browser test can show whether that browser could reach a test page and which public IP the page observed at that moment. It does not test every application, DNS request, IPv6 route, brief reconnect gap, or managed policy state. Do not force a VPN failure or use sensitive accounts to test it. See the general kill-switch guide for safer limits and the IP/DNS guide for interpreting browser checks.
Does Windows disconnect protection make browsing anonymous?
No. Blocking traffic during a VPN disconnect addresses one routing failure condition. It does not prevent websites from recognizing signed-in accounts, cookies, or browser signals, and a VPN provider still becomes an intermediary for traffic routed through its service. See the VPN visibility guide for that separate trust and visibility question.
Sources
- Microsoft Learn: VPN security features and LockDown VPN (Windows 10/11; accessed 2026-11-03)
- Microsoft Learn: VPNv2 CSP AlwaysOn profile setting (accessed 2026-11-03)
- Microsoft Learn: VPN auto-triggered profile options (accessed 2026-11-03)
- Proton VPN Support: Advanced kill switch on Windows (provider-specific example; accessed 2026-11-03)
- NordVPN Support: Windows Internet and App Kill Switch controls (provider-specific example; accessed 2026-11-03)