Set Up Windows 10 Built-in VPN Service

Windows 10 includes a built-in VPN client that lets you connect to a workplace or personal VPN server without installing third-party software. This guide walks you through configuring the VPN connection from the Settings app, then connecting and disconnecting when you need it. You’ll need the VPN server address, your username and password, and the VPN protocol your server uses (most commonly PPTP, L2TP/IPsec, SSTP, or IKEv2).

What You’ll Need

• A VPN server address (IP address or hostname like vpn.example.com)
• Your VPN username and password
• The VPN protocol type (ask your network administrator or VPN provider if unsure)
• Any pre-shared key or certificate if your VPN uses L2TP/IPsec or IKEv2
• Administrator access to your Windows 10 PC (usually you’re already the admin)

Step-by-Step

1. Open the Settings app by pressing Windows Key + I on your keyboard.
2. Click Network & Internet.
3. In the left sidebar, click VPN.
4. Click the Add a VPN connection button (it looks like a plus sign).
5. In the VPN provider dropdown, select Windows (built-in).
6. In the Connection name field, type a name you’ll recognize, like “Work VPN” or “Home VPN”. This is just a label.
7. In the Server name or address field, enter the VPN server’s IP address or hostname exactly as provided by your administrator or VPN service.
8. In the VPN type dropdown, select the protocol your server uses. Common options include:
   • Automatic – Windows tries to negotiate automatically (good if you’re unsure)
   • Point to Point Tunneling Protocol (PPTP) – older, less secure, but still used
   • L2TP/IPsec with certificate or L2TP/IPsec with pre-shared key
   • Secure Socket Tunneling Protocol (SSTP) – uses HTTPS port 443
   • IKEv2 – modern and fast, often used with certificates
9. If your VPN type uses a pre-shared key, enter it in the Pre-shared key (PSK) field. If it uses certificates, you’ll need to install the certificate separately (see Tips below).
10. In the Type of sign-in info dropdown, choose how you’ll authenticate. Most users select User name and password.
11. Enter your User name and Password in the fields provided. You can leave the password blank if you prefer to enter it each time you connect.
12. Check the box Remember my sign-in info if you want Windows to save your credentials (convenient but less secure on shared computers).
13. Click Save.
14. Your new VPN connection now appears in the VPN settings list. To connect, click on it and select Connect.
15. If prompted, enter your username and password again, then click OK.
16. Once connected, you’ll see a blue VPN badge appear in the taskbar notification area. To disconnect, click the network icon in the taskbar, click the VPN connection name, and select Disconnect.

Common Mistakes

• Wrong server address – Typing “https://” or a port number in the server field. The field expects just the IP or hostname, like 192.168.1.10 or vpn.company.com.
• Wrong VPN type – Selecting PPTP when your server uses L2TP. This causes immediate connection failure with error 800 or 806.
• Forgetting the pre-shared key – L2TP/IPsec connections fail with error 789 if the PSK is missing or incorrect.
• Username format – Some servers require the domain before the username (like DOMAIN\user) or an email address. Check with your admin if login fails.
• Leaving “Remember my sign-in info” unchecked – The connection may fail silently if credentials aren’t saved and you’re not prompted. Recheck the box and try again.
• Using the wrong network profile – If you’re on a public Wi-Fi, Windows may block VPN connections. Try switching to a private network profile or connecting via Ethernet.

Tips

• If your VPN server uses IKEv2 with certificates, you must install the server’s root certificate into the Trusted Root Certification Authorities store on your PC. Your admin usually provides this file; double-click it and choose Install Certificate, then select Local Machine and let Windows pick the store automatically.
• For L2TP/IPsec, some routers and firewalls block the necessary UDP ports (500 and 4500). If the connection times out, check with your network admin whether those ports are open.
• Use Automatic VPN type when you’re unsure of the protocol. Windows will try common options and often succeeds.
• To make the VPN connection appear in the taskbar quick settings, click the network icon, then the pencil/edit icon, and toggle the VPN connection to On.
• If you need to edit a saved VPN connection, go to Settings > Network & Internet > VPN, click the connection, and select Advanced options or Edit.
• For troubleshooting, check the Windows Event Viewer under Applications and Services Logs > Microsoft > Windows > RasClient for detailed error codes.

Troubleshooting

Error 800: Unable to establish the VPN connection. This usually means the server is unreachable or the protocol doesn’t match. Verify the server address is correct and ping it from Command Prompt (ping server-address). If ping fails, the server may be down or your network blocks ICMP. Try switching the VPN type to Automatic.

Error 806: The connection was prevented by a policy configured on your RAS/VPN server. This often indicates a protocol mismatch or the server requires a specific authentication method. Confirm the exact VPN type and sign-in method with your admin.

Error 789: The L2TP connection attempt failed because the security layer encountered a processing error. This is almost always a pre-shared key mismatch or the IPsec policy is misconfigured. Double-check the PSK and ensure the VPN type is L2TP/IPsec with pre-shared key, not with certificate.

Connection hangs at “Connecting…” then fails. Try disabling IPv6 on the VPN adapter. Go to Control Panel > Network and Sharing Center > Change adapter settings, right-click the VPN adapter, select Properties, uncheck Internet Protocol Version 6 (TCP/IPv6), and retry.

VPN connects but no internet access. The VPN may be routing all traffic through the tunnel, and the server doesn’t forward internet traffic. This is often intentional for corporate VPNs. Check with your admin. If you want split tunneling, you’ll need to configure it on the server side.

Credentials are rejected even though they’re correct. Some servers require the username in a specific format. Try domain\username, username@domain.com, or just the username. Also ensure Caps Lock is off and the password has no trailing spaces.

Frequently Asked Questions

Q: Can I use the built-in VPN client to connect to a commercial VPN service like NordVPN or ExpressVPN?
A: Generally no. Most commercial VPN services use proprietary clients or OpenVPN/WireGuard protocols, which Windows doesn’t natively support. You’d need their software or a manually configured OpenVPN client.

Q: Is the Windows 10 built-in VPN secure?
A: It depends on the protocol. IKEv2 and SSTP are considered secure. L2TP/IPsec is acceptable when configured correctly. PPTP is outdated and should be avoided unless you have no other option.

Q: Can I set up the VPN connection from Command Prompt or PowerShell?
A: Yes. You can use PowerShell with the Add-VpnConnection cmdlet, or the older rasdial command. However, the Settings app method is simpler for most users.

Q: How do I make the VPN auto-connect on startup?
A: Windows doesn’t have a built-in auto-connect option for VPN. You can create a scheduled task that runs rasdial “Connection Name” username password at logon, or use the Task Scheduler to trigger a script.

Q: Will the VPN work if I’m behind a strict firewall or proxy?
A: SSTP uses HTTPS port 443, which is usually allowed. IKEv2 uses UDP 500 and 4500, which may be blocked. If you’re behind a corporate proxy, you may need to configure proxy settings for the VPN connection in the advanced properties.

Q: Can I have multiple VPN connections configured?
A: Yes. You can add as many VPN connections as you need. Each appears in the VPN settings list and in the network flyout, so you can switch between them easily.

Related

• How to Fix Screensaver Not Working in Windows 10
• Minimize Browser Window in Selenium WebDriver
• How to Choose What Outlook Shares in Calendar