Microsoft resolved a Windows 11 issue that blocked non-admin users from connecting via Remote Desktop when Administrator protection was enabled, releasing fixes on October 28, 2026, for connection failures with error 0xC000000D.

The bug appeared after the September 22 non-security preview update, KB5124010, or later updates. Affected users could see the message, “The token that was passed to the function is invalid.”

Microsoft’s release health notice identifies enterprise-managed computers acting as Remote Desktop hosts as the main systems affected.

Microsoft opened its investigation on October 13. As detailed in Cyber Security News’ earlier coverage of the Remote Desktop connection failures, the problem prevented standard users from reaching remote systems where Administrator protection was active. The failure could occur regardless of how administrators enabled that feature.

Microsoft lists Windows 11 versions 24H2, 25H2, 26H1, and 26H2 as affected platforms. Its notice does not list Windows Server as affected by this particular issue. That scope matters because other recent Remote Desktop problems have involved different Windows releases and separate update failures.

Administrator protection limits how applications gain administrator rights. Instead of leaving those rights available throughout a session, it grants temporary access for approved tasks.

Microsoft Fixes Windows 11 Remote Desktop Failures

Cyber Security News’ explanation of Windows 11 Administrator protection describes how this approach helps reduce the risk of malware making unwanted system changes.

The setting may already be active in managed environments. Microsoft says its Windows 11 24H2, 25H2, and 26H2 security baselines enable Administrator protection by default unless an organization changes the policy. Businesses using those baselines should therefore check affected hosts rather than assume the feature was never enabled.

According to Microsoft’s release health advisory, updates released on or after October 28 resolve the issue. Systems running an applicable fixed update no longer need the temporary workaround. Microsoft recommends installing the latest security update available for the device to receive relevant fixes and improvements.

The KB5127936 release notes explicitly confirm the Remote Desktop repair. This non-security preview update applies to Windows 11 25H2 and 26H2, raising their builds to 26200.9818 and 26300.9818, respectively.

Administrators managing other affected versions should check the package offered for their specific Windows release instead of treating KB5127936 as a universal installer.

For affected computers still running older updates, Microsoft allows administrators to temporarily turn off Administrator protection through their existing management tools. The documented workaround involves resetting the “User Account Control Type Of Admin Approval Mode” policy through Microsoft Intune or Group Policy.

Because this workaround turns off a security feature, it should remain temporary. After deploying the appropriate fixed update, IT teams should verify Remote Desktop access using a non-admin account and review any policy changes made during troubleshooting. This confirms remote access works without leaving the earlier workaround in place unnecessarily.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Microsoft Fixes Remote Desktop Connection Failures Following Recent Updates appeared first on Cyber Security News.