Microsoft fixes Windows 11 Remote Desktop bug that blocked non-admin users

Microsoft resolved a Windows 11 bug that prevented non-administrator accounts from connecting via Remote Desktop when Administrator protection was enabled. Fixes were released on October 28, 2026, addressing connection failures that returned error 0xC000000D.

The problem first appeared after the September 22 non-security preview update KB5124010 and later updates. Affected users could see the message, “The token that was passed to the function is invalid.”

Microsoft’s release health notice identifies enterprise-managed Windows 11 computers acting as Remote Desktop hosts as the primary systems affected. The company opened an investigation into the issue on October 13, 2026. The bug prevented standard users from reaching remote systems where Administrator protection was active, and the failure could occur regardless of how administrators enabled that feature.

Microsoft lists Windows 11 versions 24H2, 25H2, 26H1, and 26H2 as affected platforms. The advisory does not list Windows Server as affected by this specific issue; that distinction matters because other recent Remote Desktop problems have involved different Windows releases and separate update failures.

What Administrator protection does

Administrator protection restricts how applications acquire administrator rights, granting temporary elevated access only for approved tasks instead of keeping those rights available for the entire session. This approach reduces the risk that malware or unapproved programs make unwanted system changes.

In managed environments, Administrator protection may already be enabled by default. Microsoft notes that the Windows 11 24H2, 25H2, and 26H2 security baselines enable Administrator protection unless an organization changes the policy. Organizations using those baselines should check affected hosts rather than assume the feature was never enabled.

Fixes and recommendations

According to Microsoft’s release health advisory, updates published on or after October 28, 2026, resolve the issue. Systems with an applicable fixed update no longer need the temporary workaround. Microsoft recommends installing the latest security update available for each device to receive relevant fixes and improvements.

The KB5127936 release notes explicitly confirm the Remote Desktop repair. That non-security preview update applies to Windows 11 25H2 and 26H2, updating their builds to 26200.9818 and 26300.9818, respectively. Administrators managing other affected versions should check for the specific package offered for their Windows release rather than treating KB5127936 as a universal installer.

Temporary workaround and post-fix steps

For systems that still run older updates, Microsoft allows administrators to temporarily disable Administrator protection using existing management tools. The documented workaround is to reset the “User Account Control Type Of Admin Approval Mode” policy via Microsoft Intune or Group Policy to turn Administrator protection off.

Because that workaround disables a security feature, it should only be used temporarily. After deploying the appropriate fixed update, IT teams should verify Remote Desktop access using a non-admin account and review any policy changes made during troubleshooting to ensure remote access works without leaving the temporary change in place.

Give your SOC the alert context to stop incidents quickly. Integrate threat intelligence from 16K SOCs.