Stale NRPT Policy

Describe the bug

I'm not sure if it is an OpenVPN or Windows problem.

I had several times, I think after waking up my computer (Windows 11) from sleep a state where:

• OpenVPN is disconnected,
• The NRPT policy pushed by OpenVPN is still present (see below)

I can't recover my internet connexion neither VPN because the DNS is completely broken, the only way i found was to restart my computer.

To Reproduce
Probably a race condition when pc goes out of sleep / recover Wifi / internet

Expected behavior
DNS NRPT Global Policy should have been removed or OpenVPN should have been trying to reconnect with cached DNS to remote serveur.

Version information (please complete the following information):

• OS: W11 25H2

• OpenVPN version: OpenVPN 2.7.4 [git:v2.7.4/8e9e91f4caff9a80] Windows [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [AEAD] [DCO] built on Apr 30 2026

• Repeat for peer if relevant

Additional context

=== Configuration from server

push "dns search-domains insa-toulouse.fr"
push "dns server 0 address 195.83.11.90 195.83.11.91"
push "dns server 0 transport plain"
push "dns server 0 dnssec no"

=== State on my PC

PS C:> Get-DnsClientNrptPolicy | Format-List *

DA :
DADnsServers :
DnsSec : False
DirectAccessDnsServers :
NameServers : {DNS 1 pushed by OpenVPN, DNS 2 pushed by OpenVPN}
DirectAccessEnabled :
DirectAccessIPsecCARestriction :
DirectAccessProxyName :
DirectAccessProxyType : NoProxy
DirectAccessQueryIPsecEncryption :
DirectAccessQueryIPsecRequired : False
DnsSecIPsecCARestriction :
DnsSecQueryIPsecEncryption :
DnsSecQueryIPsecRequired : False
DnsSecValidationRequired : False
NameEncoding : Utf8WithoutMapping
Namespace : .
QueryPolicy :
SecureNameQueryFallback :
PSComputerName :
CimClass : root/Microsoft/Windows/DNS : DnsClientPolicyConfiguration
CimInstanceProperties : {DirectAccessDnsServers, DirectAccessEnabled, DirectAccessIPsecCARestriction,
DirectAccessProxyName...}
CimSystemProperties : Microsoft.Management.Infrastructure.CimSystemProperties

PS C:> netsh namespace show policy

Paramètres de la table de stratégie de résolution de noms DNS

Paramètres pour .

DNSSEC (Autorité de certification) :
DNSSEC (Validation) : disabled
DNSSEC (IPSec) : disabled
DirectAccess (Autorité de certification) :
DirectAccess (Serveurs DNS) :
DirectAccess (IPSec) : disabled
DirectAccess (Paramètres de proxy) : Ignorer le proxy
Générique (serveurs DNS) : [[DNS 1 pushed by OpenVPN]]
[[DNS 2 pushed by OpenVPN]]
Générique (Déclencheur de VPN) : disabled
IDN (codage) : UTF-8 (par défaut)

PS C:> Get-DnsClientNrptRule

[[empty]]

The report provides no source file or test entry point. Start by reproducing the Windows 11 sleep and Wi-Fi recovery scenario, then inspect Get-DnsClientNrptPolicy, netsh namespace show policy, and Get-DnsClientNrptRule before and after disconnect; done means the pushed NRPT policy is removed or DNS recovery works without a reboot.