Windows VPN Says Device Missing: Repair It in Order

Two symptoms that look unrelated share a cause on Windows: a saved connection reporting that the device is missing, and an SSTP service that starts and stops within a few seconds. Neither is a password problem, and neither is fixed by recreating the profile first. The local pieces that must exist before any sign-in attempt are where the repair starts.

Work outward in the order below, and stop at the first stage that changes the symptom. Rebuilding a profile before the device exists just produces a second entry with the same message.

Start With the Services, Not the Credentials

Three services sit behind a native Windows connection: Telephony, Remote Access Connection Manager and Remote Access Auto Connection Manager. All three must run for a dial-out profile, and any of them can be left disabled by an earlier cleanup script or a hardened image. Set the ones in use to Manual or Automatic rather than leaving them at Disabled, and start them before touching anything else. Routing and Remote Access is a different component that hosts incoming connections, so enabling it is not a prerequisite for dialing out.

Get-Service -Name TapiSrv,RasMan,RasAuto | Format-Table Name,Status,StartType
Get-WinEvent -LogName System -MaxEvents 30 | Where-Object { $_.ProviderName -match 'Ras|RemoteAccess' }

A service that starts and immediately returns to Stopped is a different fault from one that was simply disabled. The matching event entry names the component that refused to continue.

Then Check the Miniports Behind the Profile

A working installation lists WAN Miniport devices for the protocols it can use, including PPTP, L2TP, IKEv2 and PPPoE. If those entries are absent or disabled, Windows has nothing to bind the connection to, and the profile keeps reporting a missing device. Open Device Manager with hidden devices shown and expand Network adapters to see the real inventory rather than the filtered one. Starting the connection manager often re-enumerates those devices, which is why a service fault can imitate absent hardware.

Enabling the miniports is a supported repair, while deleting adapters in bulk is not. The difference matters on a remote machine, where every adapter you remove is a way back in that you lose.

When SSTP Starts and Stops Inside Seconds

Two shared components sit under SSTP: the event log and the WMI repository. When that repository is damaged, the service refuses to stay running, and nothing in the VPN profile explains it. Boot into Safe Mode with an administrative session, then empty the RtBackup directory inside the WMI log folder on the system drive while leaving the directory itself present. Where renaming is blocked, clear the contents first and rename afterwards, carrying the old files into the replacement. Save the event logs and then clear them, since a service that starts on an empty RtBackup tends to fail again at the next boot while the logs stay damaged.

If Event Viewer will not open at all, the logs are the problem rather than the VPN configuration. Return to them before changing another setting.

Rebuild One Entry and Test It Alone

Every native connection lives in a phone book file, and a per-user copy sits under the roaming application data folder in the Network/Connections path. A machine-wide phone book is a separate file that can hold entries unrelated to each other. Add one new connection with the wizard, or import the package the operator supplies, and exercise that entry on its own before anything else. Replacing the phone book wholesale takes the working connections down with the broken one.

rasdial "Office VPN"
rasdial "Office VPN" /disconnect
Get-PnpDevice -Class Net | Where-Object FriendlyName -like '*WAN Miniport*'

A connection that establishes and then carries nothing has moved past this repair. On a Hyper-V host, enabling NetBIOS over TCP/IP on the virtual adapter is the missing piece in several documented SSTP cases, and checking it costs nothing. An expired password is repaired while connected, since the directory only learns the new value after a successful sign-in. Note which stage failed before moving on, since rebuilding a device path in response to an authentication error produces churn and no progress.

Services, then miniports, then one profile, then authentication, then the remote resource. That order is the whole method, and stopping at the first change is what keeps it short.