Microsoft’s Recent Windows Updates Break Remote Desktop Services With Error “0xC000000D”

Microsoft has confirmed a Windows 11 Remote Desktop issue that can prevent non-admin users from connecting to remote computers with Administrator protection enabled. The problem follows the September 22, 2026, non-security preview update, KB5124010, or later updates. It mainly affects company-managed computers used as Remote Desktop hosts.

Failed connections may return error 0xC000000D and display the message, “The token that was passed to the function is invalid.” Microsoft opened the issue on October 13 and updated its status to “Mitigated” that morning. A temporary workaround is available, but the company is still developing a permanent fix.

Affected Windows 11 Systems

Microsoft lists Windows 11 versions 24H2, 25H2, 26H1, and 26H2 as affected. Windows Server is not affected by this specific issue. The failure occurs when Administrator protection is enabled on the remote host, regardless of how administrators turned on the feature.

This makes the host’s security settings an important part of troubleshooting. Support teams investigating matching failures should check the installed Windows updates, confirm the reported error, and review whether Administrator protection is active before making policy changes. These checks help identify computers that match Microsoft’s description of the problem.

Administrator protection limits how Windows grants powerful system permissions. As explained in Cyber Security News’ coverage of Windows 11 Administrator protection, the feature creates a separate, temporary admin token after the user approves an administrative task. Windows removes that token when the process ends, helping prevent malware from silently gaining admin rights.learn.microsoft+1

Organizations using Microsoft’s Windows security baselines should review their settings carefully. The baselines for Windows 11 versions 24H2, 25H2, and 26H2 enable Administrator protection unless the organization has changed the policy. Microsoft’s updated 26H2 security baseline also recommends testing the configuration against business needs.

Microsoft advises IT administrators to temporarily disable Administrator protection on affected Remote Desktop hosts through their existing management tools. The workaround requires resetting the “User Account Control Type Of Admin Approval Mode” policy through Microsoft Intune or Group Policy.

Because this removes an added security safeguard, organizations should limit the change to affected devices and record the exception for later review.

Cyber Security News previously covered separate Remote Desktop credential prompt failures. Administrators should not assume those earlier fixes address this issue. Microsoft’s current release-health notice says a future Windows update will provide the permanent resolution, with further details to follow.

An EDR alert reveals an attack. But can it tell the full story? Discover how to reconstruct the attack timeline.