Windows client detects running windows wireguard tunnel services and displays them as connected on startup. This shouldn't happen with MFA enabled locations as those connections are most likely dead and should be disconnected instead.