Why Windows keeps asking for your VPN password

Your password is saved, the checkbox is ticked, and the next connection still asks for the credential. That loop has three possible causes on Windows: a machine-wide policy that forbids saving, a profile that lives in a different store from the account using it, or an authentication method that the profile wizard never wrote down. Each is fixed somewhere else, and changing the wrong one produces the comforting impression of progress while the box stays empty. Naming the cause first is what turns the loop into a two-minute check.

A Machine Policy Can Forbid Saving

A single value in the Remote Access Service configuration can switch off credential saving for the whole computer. While it is active, ticking the box changes nothing, because the client has nowhere to put the secret. The next attempt therefore starts with an empty field, and no profile-level setting can override it. This is the first thing to read, since it is the only one of the three causes that affects every account at once.

reg query "HKLM\SYSTEM\CurrentControlSet\Services\RasMan\Parameters" /v DisableSavePassword
Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Services\RasMan\Parameters" | Select-Object DisableSavePassword

Read the value before rebuilding the connection, and treat a machine configured this way as deliberate rather than broken: zero is the normal state and one blocks saving for every profile on the box. On a managed device, ask the policy owner to change it instead of editing the registry under your own account. A refresh will restore the old value within a week, and the user will conclude that the fix never worked. That is why a local edit looks like a failure later on. Ask whether the restriction is intended before fighting it.

The Profile May Sit in the Other Store

Windows keeps one phone book per account and one for the whole machine, and a connection created in the first is invisible to the second. The symptom is a missing connection or a prompt that never offers the saved credential. Listing both scopes takes one command each and settles the question in seconds. Do that before deciding the credential was lost.

Get-VpnConnection | Format-List Name,AuthenticationMethod,ServerAddress
Get-VpnConnection -AllUserConnection | Format-List Name,AuthenticationMethod,ServerAddress

Create the profile with the all-user option when every account on the machine has to use it. The listing also shows the authentication method next to each name, which narrows the investigation immediately. Scope decides where configuration lives; it does not turn the connection into a device tunnel or share one user credential with everyone. It also interacts with startup, because a service account that dials at boot cannot see a profile created in a user store.

The Wizard May Never Have Written the Method

The IKEv2 wizard has a long-standing rough edge. Selecting username and password authentication does not always get stored, and the next visit to the wizard presents the generic entry again. The stored value is what the client consults at connect time, so a missing method looks exactly like a missing password. What remains is a profile with no authentication method, which leaves a saved secret with nothing to bind to.

Set-VpnConnection -Name "Corp" -AuthenticationMethod EAP -AllUserConnection
Get-VpnConnection -Name "Corp" -AllUserConnection | Select-Object AuthenticationMethod
rasphone -l

Setting the method explicitly avoids the dialog entirely, and reading the value back proves what was written. A value that reverts on its own means something else is rewriting the profile.

Confirm With a Sign-Out, Not a Reconnect

Reconnecting inside one session reuses state that a real sign-in rebuilds, so it can hide a store problem completely. Log off, log back on, and start the connection while watching whether a credential is offered or requested. Then run the listings again, because the profile should appear in the store you expect and the method should still be the one you set. A same-session retry proves only that the cached credential was still in memory.

whoami
Get-VpnConnection -AllUserConnection | Format-List Name,AuthenticationMethod
Get-VpnConnection | Format-List Name,AuthenticationMethod
rasdial "Corp"

If the prompt returns anyway, the remaining candidate is the method itself, or a policy refresh has quietly restored the original restriction. Check those two before reinstalling a client that was never involved. Both leave their own trace in the listing output.

Record the cause you changed and the evidence that confirmed it. A profile refresh can bring the empty box back, and the note is what makes the repeat cheap.