AnyConnect Says VPN Service Is Not Available: Fix on Windows

The dialog appears the moment you click Connect, before any credential prompt, and it says the VPN service is not available. Nothing has left the machine yet. AnyConnect's window talks to a local Windows service, and when that conversation fails the client gives up before it ever names a gateway. That ordering is the most useful clue in the whole message: you are debugging a service and a driver, not a certificate or a firewall rule on the far side. Here is the order I work through, cheapest check first.

The dialog appears before the gateway is contacted

The window is a thin front end. It asks the agent service to build the tunnel, and that service owns the adapter, the routing changes and the profile store. If the service is missing, stopped or blocked, the front end has nothing to talk to and reports exactly this.

The practical consequence is simple: no server name, no credential prompt, no certificate error. If you see any of those, stop reading this and look at the tunnel instead.

Check the agent service before anything else

Open services.msc and find Cisco AnyConnect Secure Mobility Agent. If the startup type is Disabled, set it to Automatic and start it. A service disabled by an upgrade or left behind by a crash often starts cleanly once and stays up. If it dies again within seconds, note the error code and keep reading.

Two supporting services are worth a look on stubborn machines. Restarting the Base Filtering Engine has cleared this message when the filter driver was wedged. Where Internet Connection Sharing was enabled, switching ICS off has done the same, because the two compete for the same network plumbing.

On a managed laptop the service may be disabled by policy on purpose, so confirm with whoever owns the device before you re-enable it.

Then check the virtual adapter

AnyConnect needs its own virtual adapter, and a disabled one produces the same dialog on some builds. Open Network Connections, find the Cisco AnyConnect Secure Mobility Client entry, and enable it if it is greyed out. The same panel handles the stuck case: an interface sitting in connecting state usually cannot be removed from Settings, but it can be disabled and deleted here.

If the adapter is missing entirely, the driver did not install. That points at the next section rather than at anything you can toggle.

When a restart does not hold

A leftover install directory can restore the broken state on every boot. Uninstall the client, delete the Cisco AnyConnect folder under ProgramData, reboot, then reinstall the same version. Removing that folder is what clears profiles and machine policy fragments the uninstaller leaves behind. A newer major version can also clear the message, but only if your gateway accepts that client version.

macOS users meet the same wording through a different component. The agent is a launchd job, so load it and confirm the app is allowed to run in the background. On current releases that switch lives under Login Items and Extensions, and an app turned off there starts and then fails with this exact message.

When a second VPN client is the cause

Two clients can fight over filter drivers and adapter priority. A Forti client installed beside an older Cisco client has left people connected but unable to reach anything, and removing the unused client restored service. The workable alternative is explicit routes per VPN subnet, so each client's addresses land on the right adapter instead of depending on metric order.

If both clients have to stay, decide the routes deliberately and write them down. Metric guessing breaks on the next update.

A fix order that does not need two reinstalls

Before you reinstall, capture the agent log. The message covers several distinct failures, and the log is the only thing that separates them after the fact. Then run this order and stop at the first step that changes the behaviour:

• Agent service present, startup type Automatic, running before the GUI starts.
• Virtual adapter enabled in Network Connections, no interface stuck in connecting state.
• Internet Connection Sharing off, Base Filtering Engine healthy.
• ProgramData folder removed before a reinstall, same version reinstalled.
• No second VPN client holding the same filter drivers.

If the client exits before showing a server name or a credential prompt, nothing on the network was contacted. A fourth reinstall will not find a cause that a service state would have shown you in two minutes.