Microsoft: Recent Windows updates may trigger Remote Desktop failures
Microsoft says recent Windows 11 updates can break Remote Desktop for non-admins when Administrator protection is enabled.
Microsoft confirmed that non-admin users may fail to connect over Remote Desktop after installing the September 2026 KB5124010 preview or later updates when Administrator protection is enabled. Affected systems include Windows 11 24H2, 25H2, 26H1 and 26H2; connections can return error 0xC000000D. The feature is enabled by default in the relevant Windows security baselines. Until a fix ships, administrators can disable Administrator protection through Intune or Group Policy.
- Non-admin Remote Desktop connections can fail with error 0xC000000D.
- Issue follows KB5124010 or later on Windows 11 24H2 through 26H2.
- Administrator protection is default in affected Windows security baselines.
- Temporary fix is disabling Administrator protection via policy.
- Microsoft previously fixed similar Remote Desktop failures in 2025 and September 2026.
Full article376 words · extracted from bleepingcomputer.com · click to collapse
Microsoft has confirmed that non-admin users may be unable to connect to devices via Remote Desktop after installing recent Windows updates if the "Administrator protection" security feature is enabled.
This feature began rolling out with the KB5067036 preview cumulative update to systems running Windows 11 24H2/25H2 in October 2025, and it is now enabled by default in organizations using Windows security baselines after installing the October 2026 Windows security update.
When toggled on, admin protection ensures logged-in users have only standard user permissions and prompts them to authenticate via Windows Hello (PIN or biometric) when they try to install new apps or change the Windows registry.
On Tuesday, Microsoft confirmed that Remote Desktop connections may fail with error 0xC000000D after installing the KB5124010 September 2026 non-security preview update or later updates on systems running Windows 11 24H2/25H2/26H1/26H2.
"Attempts to connect might fail with error 0xC000000D and display the message, 'The token that was passed to the function is invalid.' This issue primarily affects enterprise-managed remote devices used as Remote Desktop hosts with Administrator protection enabled, regardless of how the feature was enabled," it said.
"If your organization uses Windows security baselines, published through the Microsoft Security Compliance Toolkit, Administrator protection is enabled by default in Windows 11, version 24H2, 25H2, and 26H2 security baselines, unless your organization has configured the policy differently."
While the company continues to work on this issue, it has shared a temporary workaround that requires IT admins to disable Administrator protection through a policy management method of their choice.
For instance, if you use Microsoft Intune or Group Policy, you'll need to reset the "User Account Control Type Of Admin Approval Mode" policy.
Microsoft fixed a similar issue in March 2025 that caused Remote Desktop and RDS connection failures after installing Windows updates released since January 2025.
Last month, it also released emergency out-of-band Windows updates to fix Remote Desktop Services failures on Windows Server devices caused by the September 2026 security updates.
Build your security blueprint for AI-powered attacks
Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.