Microsoft: Remote Desktop to Windows 11 hosts with Administrator protection may fail for non-admin users with error 0xC000000D after the September preview (KB5124010) or later updates, including October; security baselines turn the feature on
Microsoft opened a Windows release health known issue on 13 October 2026 (09:43 PT; 14 October Perth time): after the September 2026 non-security preview update KB5124010 or later updates, non-admin users might be unable to connect over Remote Desktop to devices that have Administrator protection enabled. Connections fail with error 0xC000000D and the message 'The token that was passed to the function is invalid.' It mainly hits enterprise-managed Remote Desktop hosts, however the feature was enabled. Administrator protection gives signed-in users standard rights and asks for Windows Hello to elevate; Microsoft notes it is enabled by default in the Windows 11 24H2, 25H2 and 26H2 security baselines from the Security Compliance Toolkit, and BleepingComputer reports it now lands by default in organisations using those baselines after the October 2026 security update. Affected: Windows 11 24H2, 25H2, 26H1 and 26H2 clients; no server versions. Microsoft lists the issue as mitigated by a workaround and is working on a fix. This is a reliability problem, not a vulnerability. Primary: Microsoft Windows release health.
- Product
- Windows 11 Remote Desktop hosts with Administrator protection enabled
- Versions
- Windows 11 24H2, 25H2, 26H1 and 26H2 after KB5124010 (22 Sep 2026 preview) or later updates, including the October 2026 security update. Server: none.
- Exploited in Australia?
- unknown
- Patch to
- Keep installing the October security update. If non-admin RDP users hit 0xC000000D, temporarily turn off Administrator protection on affected hosts by resetting the 'User Account Control Type Of Admin Approval Mode' policy in Intune or Group Policy, and re-enable it once Microsoft ships the fix.
Primary: Microsoft Windows release health — Remote Desktop connections might fail for non-admin users with error 0xC000000D (opened 13 Oct 2026) · BleepingComputer — Microsoft: Recent Windows updates may trigger Remote Desktop failures (14 Oct 2026)