Microsoft has acknowledged a significant issue affecting non-admin users attempting to connect to devices via Remote Desktop following the installation of recent Windows updates. This complication arises specifically when the “Administrator protection” security feature is activated.
Details of the Administrator Protection Feature
The Administrator protection feature was introduced with the KB5067036 preview cumulative update for Windows 11 versions 24H2 and 25H2 in October 2025. As of the October 2026 Windows security update, this feature has become the default setting for organizations utilizing Windows security baselines.
When enabled, this feature restricts logged-in users to standard user permissions. It also prompts users to authenticate through Windows Hello—either via a PIN or biometric verification—when they attempt to install new applications or modify the Windows registry.
Connection Issues and Error Messages
On Tuesday, Microsoft reported that users may encounter connection failures with error code 0xC000000D after applying the KB5124010 September 2026 non-security preview update or any subsequent updates on systems running Windows 11 versions 24H2, 25H2, 26H1, or 26H2.
The company stated, “Attempts to connect might fail with error 0xC000000D and display the message, ‘The token that was passed to the function is invalid.’ This issue primarily impacts enterprise-managed remote devices configured as Remote Desktop hosts with Administrator protection enabled, irrespective of how the feature was activated.”
Furthermore, it was noted that for organizations employing Windows security baselines—available through the Microsoft Security Compliance Toolkit—Administrator protection is enabled by default in Windows 11 versions 24H2, 25H2, and 26H2, unless otherwise configured by the organization.
Temporary Workaround and Previous Issues
While Microsoft is actively working to resolve this issue, a temporary workaround has been provided. IT administrators are advised to disable Administrator protection using their preferred policy management method.
- If utilizing Microsoft Intune or Group Policy, administrators should reset the “User Account Control Type Of Admin Approval Mode” policy.
This is not the first time Microsoft has addressed similar issues; a comparable problem was rectified in March 2025, which resulted in Remote Desktop and RDS connection failures following updates released since January 2025. Additionally, last month, the company issued emergency out-of-band Windows updates to rectify Remote Desktop Services failures on Windows Server devices caused by the September 2026 security updates.
