Windows updates block non-admin Remote Desktop access

A failed connection can return error 0xC000000D with the message: "The token that was passed to the function is invalid."

The problem affects enterprise-managed devices used as Remote Desktop hosts after installing the KB5124010 September 2026 non-security preview update, released September 22, or a later update. Microsoft lists Windows 11 24H2 and 25H2 as affected versions. It also names 26H1 and 26H2. The company says the issue mainly affects organization-managed remote devices, including systems where a security baseline enables Administrator protection.

For IT teams relying on those hosts, Microsoft's immediate workaround is to disable Administrator protection.

Administrators can turn off the feature through their usual policy management method. In Microsoft Intune or Group Policy, they should reset the "User Account Control Type Of Admin Approval Mode" policy. Microsoft first described this as a temporary measure while it developed a fix. Its Windows 11 release-health notice now lists the issue as mitigated. For Windows 11 25H2, the October 13, 2026 update KB5127648 or a later update resolves the problem. The workaround is unnecessary after installation, according to Microsoft's 25H2 update guidance.

Administrator protection keeps logged-in users at standard permissions. When they install apps or change the Windows registry, Windows requests authentication through Windows Hello, using a PIN or biometric check. The feature began rolling out with the KB5067036 preview cumulative update for Windows 11 24H2 and 25H2 in October 2025.

Microsoft says Administrator protection is enabled by default in organizations using Windows security baselines after installing the October 2026 Windows security update. The 24H2 and 25H2 baselines enable the setting. The 26H2 baseline does too, unless an organization has configured the policy differently. Microsoft opened its release-health record for the issue on October 13 at 9:43 a.m. Pacific time, then changed the status to "Mitigated" 30 minutes later, at 10:13 a.m.

Another recent Windows update problem has disrupted enterprise workflows. Microsoft acknowledged that the September 2026 security update breaks apps using Dolby Digital AC-3, as covered in this report on app failures.

Microsoft fixed a similar Remote Desktop and Remote Desktop Services connection problem in March 2025. Updates released since January 2025 had caused those failures. Last month, the company also issued emergency out-of-band Windows updates for Remote Desktop Services failures on Windows Server devices linked to the September 2026 security updates.

For the current issue, Microsoft advises organizations to reset the specified policy and disable Administrator protection on affected systems until they install the applicable fix. Organizations that changed the policy as a workaround can restore the protection setting to their required configuration after updating.