"Attempts to connect might fail with error 0xC000000D and display the message, 'The token that was passed to the function is invalid.'" That is Microsoft's description of a Remote Desktop failure confirmed on Tuesday affecting enterprise-managed Remote Desktop hosts when Administrator protection is enabled.
What Microsoft confirmed about Remote Desktop failures
Microsoft said non‑administrator users may be unable to connect to devices via Remote Desktop after installing recent Windows updates if the "Administrator protection" security feature is enabled. The company attributed the connection failures to updates beginning with the KB5124010 September 2026 non‑security preview update and later releases on systems running Windows 11 24H2, 25H2, 26H1 and 26H2.
Microsoft characterized the problem as primarily affecting enterprise‑managed remote devices used as Remote Desktop hosts with Administrator protection enabled, "regardless of how the feature was enabled." The observable symptom is connection attempts failing with error 0xC000000D and the accompanying invalid token message.
Which updates and Windows versions are implicated
The company tied the failures specifically to devices that installed the KB5124010 September 2026 non‑security preview update or later updates. Affected Windows builds include Windows 11 versions 24H2, 25H2, 26H1 and 26H2. Microsoft also noted that Administrator protection is now enabled by default in organizations that adopt Windows security baselines after installing the October 2026 Windows security update.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildAdministrator protection: rollout and intended behavior
Administrator protection began rolling out with the KB5067036 preview cumulative update to systems running Windows 11 24H2 and 25H2 in October 2025. When enabled, Administrator protection changes the session model for logged‑in users so they operate with standard user permissions and are prompted to authenticate via Windows Hello — PIN or biometric — when attempting to install new applications or modify the Windows registry.
Microsoft emphasized that, in environments using the Windows security baselines published through the Microsoft Security Compliance Toolkit, Administrator protection is enabled by default in the Windows 11 24H2, 25H2 and 26H2 security baselines "unless your organization has configured the policy differently."
Temporary workaround for IT administrators
While Microsoft continues to work on a permanent fix, it has published a temporary mitigation that requires IT administrators to disable Administrator protection through policy management. For organizations using Microsoft Intune or Group Policy, Microsoft advised resetting the "User Account Control Type Of Admin Approval Mode" policy to disable Administrator protection.
The guidance is explicitly framed as a stopgap: Microsoft is still working on the underlying issue, and the remediation offered is a configuration change performed through existing policy management tools.
How technologists, IT administrators, and end users are likely to respond
- Technologists and security teams will monitor the specific KBs called out by Microsoft — notably KB5124010 (September 2026 non‑security preview) and the October 2026 security update that enabled Administrator protection by default in baselines — while tracking Microsoft's forthcoming fix.
- IT administrators and procurement leaders will face an operational choice: accept the temporary reduction in protection by resetting the "User Account Control Type Of Admin Approval Mode" policy to restore Remote Desktop connectivity, or keep Administrator protection enabled and block non‑admin Remote Desktop sessions until Microsoft issues a fix.
- End users who rely on enterprise‑managed Remote Desktop hosts may encounter connection failures (error 0xC000000D) when attempting to access remote systems if their organization has Administrator protection enabled and has applied the implicated updates.
Microsoft's advisory comes after a pattern of similar disruptions: the company fixed a comparable issue in March 2025 that caused Remote Desktop and RDS connection failures after updates issued since January 2025, and it also shipped emergency out‑of‑band Windows updates last month to remedy Remote Desktop Services failures on Windows Server devices caused by the September 2026 security updates. For now, Microsoft is working on a permanent solution and has given administrators a policy‑based workaround to restore connectivity.
Original story: https://www.bleepingcomputer.com/news/security/microsoft-recent-windows-updates-may-trigger-remote-desktop-failures/
