Windows 11 Remote Desktop Connections Fail for Non-Admins When Administrator Protection Is Enabled
Microsoft has confirmed that non-administrator users may be unable to connect to Windows devices through Remote Desktop after installing the latest Windows updates when the Administrator Protection security feature is enabled.
Windows 11 Remote Desktop error 0xC000000D
The issue affects systems running Windows 11 24H2, 25H2, 26H1, and 26H2 after installing the KB5124010 September 2026 Non-Security Preview Update or a later update.
Microsoft says affected Remote Desktop connection attempts may fail with error 0xC000000D and display the message: The token passed to the function is invalid.
Microsoft said the problem primarily affects corporate-managed remote devices used as Remote Desktop hosts with Administrator Protection enabled, regardless of how the feature was enabled.
What is Administrator Protection?
Administrator Protection began rolling out in October 2025 with preview cumulative update KB5067036 for Windows 11 24H2 and 25H2 systems. It is also enabled by default for organizations using Windows Security Baselines after installing the October 2026 Windows Security Updates.
When Administrator Protection is enabled, signed-in users operate with standard user permissions. Windows then prompts them to authenticate with Windows Hello, such as a PIN or biometric authentication, when they attempt to install applications or modify the Windows registry.
Microsoft added that Administrator Protection is enabled by default in the Windows 11 24H2, 25H2, and 26H2 security baselines published through the Microsoft Security Compliance Toolkit, unless an organization configures its policies differently.
Microsoft shares a temporary workaround
Microsoft is continuing to investigate the Remote Desktop connectivity problem. In the meantime, IT administrators can work around the issue by disabling Administrator Protection through their preferred policy management method.
For example, organizations using Microsoft Intune or Group Policy must reset the Administrator Approval Mode User Account Control Type policy.
Administrators should consider the security implications before changing this policy, particularly on corporate-managed Remote Desktop hosts.
Previous Windows Remote Desktop issues
Microsoft fixed a similar problem in March 2025 that caused Remote Desktop and Remote Desktop Services connectivity failures after Windows updates released after January 2025.
Last month, Microsoft also released an emergency out-of-band Windows update to fix a Remote Desktop Services failure on Windows Server devices caused by the September 2026 security update.
Read Microsoft’s advisory for the latest details about the Windows 11 Remote Desktop issue and available mitigations.
Join Mikko Hypponen and security leaders from the NFL, Chanel, and Atlassian for a 2-hour digital summit about what will change with AI speed attacks, what defenders should stop doing, and how to verify, decide, fix, and revalidate at machine speed.
Source: www.bleepingcomputer.com