Microsoft has confirmed that recent Windows updates can prevent non-admin users from connecting to devices over Remote Desktop when the "Administrator protection" security feature is enabled.
The company said connection attempts may fail with error 0xC000000D and the message "The token that was passed to the function is invalid." The issue affects systems running Windows 11 versions 24H2, 25H2, 26H1 and 26H2, and is triggered by the KB5124010 September 2026 non-security preview update or later updates.
Administrator protection, which began rolling out with the KB5067036 preview cumulative update in October 2025, gives logged-in users standard user permissions and prompts for Windows Hello authentication, such as a PIN or biometric check, before apps can be installed or the Windows registry changed. Microsoft noted that the feature is now enabled by default in organizations using Windows security baselines published through the Microsoft Security Compliance Toolkit on Windows 11 24H2, 25H2 and 26H2, "unless your organization has configured the policy differently."
The problem "primarily affects enterprise-managed remote devices used as Remote Desktop hosts with Administrator protection enabled, regardless of how the feature was enabled," Microsoft said.
While the company continues work on a fix, it has shared a temporary workaround: IT admins can disable Administrator protection through a policy management method of their choice, such as Microsoft Intune or Group Policy, by resetting the "User Account Control Type Of Admin Approval Mode" policy.
This is not the first such incident. Microsoft fixed a similar issue in March 2025 that caused Remote Desktop and Remote Desktop Services connection failures after updates released since January 2025, and last month released emergency out-of-band updates to fix Remote Desktop Services failures on Windows Server caused by the September 2026 security updates.