Always On VPN device tunnel connects but user tunnel fails

Scenario

The workstation establishes the device tunnel before sign-in, but the user tunnel never comes up after authentication.

Recommended Resolution Path

1. Confirm the certificate and profile assignment differ correctly between device and user tunnel scopes.
2. Review RasClient logs and NPS or gateway logs for auth failures.
3. Check whether user tunnel DNS suffixes or route settings conflict with the device tunnel.
4. Test with a clean user profile on the same device to separate user context from machine state.

Technician Notes

Document what changed, what confirmed the fix, and whether the issue points to a broader standards gap worth addressing for the client.