Microsoft Windows Updates Break Remote Desktop Services

Key Takeaways

• A recent Windows 11 update is causing Remote Desktop connection failures for non-administrative users.
• The issue specifically impacts devices with “Administrator protection” enabled, primarily affecting corporate environments.
• Affected Windows 11 versions include 24H2, 25H2, 26H1, and 26H2; Windows Server is not impacted.
• Microsoft has acknowledged the problem, provided a temporary workaround, and is developing a permanent fix.

Microsoft has confirmed a critical flaw in Windows 11 that disrupts Remote Desktop services, preventing non-administrator users from connecting to remote machines where Administrator protection is active. This problem emerged following the September 22, 2026, non-security preview update, KB5124010, and subsequent updates. The impact is largely observed on company-managed devices configured as Remote Desktop hosts.

Attempts to establish a connection often result in error code 0xC000000D, accompanied by the message, “The token that was passed to the function is invalid.” Microsoft officially recognized this issue on October 13, swiftly updating its status to “Mitigated” later that morning. While a temporary workaround is available, the company is still actively working on a definitive solution.

Affected Systems and Technical Details

Specific Windows 11 Versions Impacted

The issue specifically targets Windows 11 versions 24H2, 25H2, 26H1, and 26H2. Notably, this particular problem does not affect Windows Server operating systems. The connection failures manifest when Administrator protection is enabled on the remote host, irrespective of the method used to activate this security feature.

Consequently, the security configuration of the host machine is paramount for effective troubleshooting. Support teams investigating similar failures should verify installed Windows updates, confirm the reported error message, and ascertain whether Administrator protection is active before implementing any policy modifications. These diagnostic steps are crucial for identifying systems that align with Microsoft’s description of the problem.

Understanding Administrator Protection

Administrator protection is a security mechanism designed to restrict how Windows grants elevated system permissions. This feature operates by generating a distinct, transient administrative token only after a user approves an administrative task. Upon completion of the process, Windows revokes this token, thereby mitigating the risk of malware silently acquiring administrative privileges.

Organizations leveraging Microsoft’s comprehensive Windows security baselines must scrutinize their configurations. The security baselines for Windows 11 versions 24H2, 25H2, and 26H2 activate Administrator protection by default, unless an organization has explicitly altered this policy setting. Microsoft’s updated 26H2 security baseline further advises thorough testing of this configuration against specific business requirements.

What You Should Do

• Temporarily Disable Administrator Protection: Microsoft recommends that IT administrators temporarily deactivate Administrator protection on affected Remote Desktop hosts. This can be achieved by resetting the “User Account Control Type Of Admin Approval Mode” policy using existing management tools like Microsoft Intune or Group Policy.
• Limit Scope of Workaround: Since this action reduces a security safeguard, organizations should restrict this policy change to only the demonstrably affected devices. It is also critical to document these exceptions for future review and remediation.
• Stay Informed: This issue is distinct from earlier Remote Desktop credential prompt failures. Administrators should not assume prior fixes address this new problem. Microsoft’s current release-health notice indicates that a future Windows update will deliver the permanent resolution, with more details to be announced.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.