Key points
- Non-administrator users may see error 0xC000000D when connecting to affected Windows 11 hosts.
- The issue is linked to the September 22 preview update KB5124010 and subsequent updates.
- Microsoft advises disabling Administrator protection as a temporary workaround for affected systems.
Microsoft has confirmed that recent Windows 11 updates are disrupting Remote Desktop connections for non-administrator users on enterprise-managed devices. According to TechRepublic, the company identifies Administrator protection as the security feature causing these failures. The issue emerged following the release of update KB5124010 on September 22 and subsequent updates. Affected users encounter connection errors that require a trade-off between security and access.
By the numbers
- Error code 0xC000000D appears when non-administrator users attempt to connect to affected Remote Desktop hosts.
- Windows 11 versions 24H2, 25H2, 26H1, and 26H2 are identified as affected by this configuration issue.
- The problem was officially documented by Microsoft on October 14, linking it to the September 22 update.
What the figures mean
The error code 0xC000000D, accompanied by the message “The token that was passed to the function is invalid,” indicates a failure in token validation during the Remote Desktop login process. According to Microsoft’s update documentation, this occurs specifically when non-administrator users connect to hosts with Administrator protection enabled.
This feature, designed to limit elevated privileges during routine activity, uses Windows Hello authentication to authorize administrative actions. The failures are not present on systems where this protection is disabled by default, but it is enabled in Microsoft’s security baselines for the listed Windows 11 versions unless organizations override the policy.
What to watch
Administrators should monitor their enterprise environments for reports of Remote Desktop connection failures, particularly for standard user accounts. The recent Windows 11 26H2 rollout uses an enablement package for eligible 24H2 and 25H2 PCs, while 26H1 follows a separate servicing path, meaning the issue may propagate differently across versions. Microsoft states this failure differs from a separate Remote Desktop Services regression reported in September 2026. Organizations relying on Administrator protection for security baselines should verify which devices are affected before applying the temporary workaround, as disabling the feature reduces a security safeguard.
Infection and persistence in general
When analyzing Remote Desktop access issues, security teams usually examine authentication logs for failed login attempts and token validation errors. They check whether the issue correlates with recent patch deployments or policy changes. Analysts typically review Group Policy Objects to ensure security features like Administrator protection are configured as intended. They also verify that user accounts have the correct permissions and that no conflicting security software is interfering with the connection. This approach helps distinguish between configuration errors and actual security breaches.
What to do and how to stay safe: Windows 11
- Verify the Windows version and installed updates on affected Remote Desktop hosts to confirm if they match the affected list.
- Check if Administrator protection is enabled on the host and whether non-administrator users are experiencing connection errors.
- Consider disabling Administrator protection temporarily on affected hosts to restore remote access, acknowledging the reduced security posture.
- Monitor Microsoft’s update guide for official patches or further guidance on resolving the token validation failure without disabling security features.
Step-by-step guide: Patch Management Implementation: A Step-by-Step Rollout Plan
General security guidance from the Sandbox Gazette newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which Windows 11 versions are affected by the Remote Desktop connection failures?
Windows 11 versions 24H2, 25H2, 26H1, and 26H2 are affected, particularly when Administrator protection is enabled.
What is the temporary workaround for the Remote Desktop connection failures?
Microsoft advises disabling Administrator protection on affected Remote Desktop hosts to restore access for non-administrator users.
Is there an official patch available for this issue yet?
No fix has been confirmed yet; Microsoft has only provided a temporary workaround involving disabling the security feature.
