Microsoft has rolled out a fix for a Remote Desktop issue in Windows 11 that prevented standard (non-administrator) users from connecting to remote systems when Administrator protection was enabled. The error, identified as 0xC000000D, appeared after installing Microsoft’s non-security preview update KB5124010 (released September 22, 2026) or any later update. Affected users saw messages stating that “the token that was passed to the function is invalid.”
Who Was Affected & What Was the Cause
The bug targeted enterprise-managed machines that serve as Remote Desktop hosts, specifically when Administrator protection was in effect. Microsoft flagged Windows 11 versions 24H2, 25H2, 26H1, and 26H2 as impacted platforms. Windows Server editions were not included in that list this time. Although Administrator protection helps limit elevated permissions to specific tasks rather than maintaining broad admin access throughout a session, it appears to have been the trigger for the Remote Desktop failure.
Microsoft first began investigating the issue on October 13, 2026, after reports that non-admin users were unable to establish Remote Desktop sessions under these conditions. The root cause was tied to how administrative approval types were being handled when Administrator protection was turned on.
The Fix & Temporary Workarounds
On October 28, Microsoft released updates that address the problem for all affected Windows 11 versions. A new non-security preview build, KB5127936, updates Windows 11 25H2 and 26H2 to builds 26200.9818 and 26300.9818 respectively, explicitly including a repair for the Remote Desktop connectivity issue.
Organizations using earlier builds still suffering from the issue have a stop-gap workaround: disable Administrator protection temporarily via policy tools like Microsoft Intune or Group Policy by resetting the “User Account Control Type Of Admin Approval Mode” setting. However, Microsoft warns that this reduces security and should only be a short-term fix until the patched update is deployed.
After applying the fix, administrators are advised to verify Remote Desktop access using a non-admin account and to track any policy changes made during the troubleshooting process. This ensures access is restored without leaving unintended security gaps in place.
Windows 11 security baselines for 24H2, 25H2, and 26H2 typically enable Administrator protection by default—unless explicitly altered by organizational policy. Because of that, many enterprise environments may have been affected even without knowingly enabling the setting.
Having a feature designed to protect systems unwittingly disabling essential remote access highlights the complexity of balancing security and usability. Businesses running Windows 11 in managed environments should make installing the October 28 update a priority if they experienced Remote Desktop issues. Moving forward, tighter testing around security changes to remote access features will be critical to prevent similar disruptions.
