Microsoft has confirmed that non-admin users may be unable to connect to devices via Remote Desktop after installing recent Windows updates if the "Administrator protection" security feature is enabled.
This feature began rolling out with the KB5067036 preview cumulative update to systems running Windows 11 24H2/25H2 in October 2025, and it is now enabled by default in organizations using Windows security baselines after installing the October 2026 Windows security update.
When toggled on, admin protection ensures logged-in users have only standard user permissions and prompts them to authenticate via Windows Hello (PIN or biometric) when they try to install new apps or change the Windows registry.
On Tuesday, Microsoft confirmed that Remote Desktop connections may fail with error 0xC000000D after installing the KB5124010 September 2026 non-security preview update or later updates on systems running Windows 11 24H2/25H2/26H1/26H2.
"Attempts to connect might fail with error 0xC000000D and display the message, 'The token that was passed to the function is invalid.' This issue primarily affects enterprise-managed remote devices used as Remote Desktop hosts with Administrator protection enabled, regardless of how the feature was enabled," it said.
"If your organization uses Windows security baselines, published through the Microsoft Security Compliance Toolkit, Administrator protection is enabled by default in Windows 11, version 24H2, 25H2, and 26H2 security baselines, unless your organization has configured the policy differently."
While the company continues to work on this issue, it has shared a temporary workaround that requires IT admins to disable Administrator protection through a policy management method of their choice.
For instance, if you use Microsoft Intune or Group Policy, you'll need to reset the "User Account Control Type Of Admin Approval Mode" policy.
Microsoft fixed a similar issue in March 2025 that caused Remote Desktop and RDS connection failures after installing Windows updates released since January 2025.
Last month, it also released emergency out-of-band Windows updates to fix Remote Desktop Services failures on Windows Server devices caused by the September 2026 security updates.
Build your security blueprint for AI-powered attacks
Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.
Save your seat