Microsoft addressed a Windows 11 issue that prevented non-administrative users from connecting via Remote Desktop when Administrator protection was enabled, releasing fixes on October 28, 2026, for connection failures with error 0xC000000D This article explores desktop administrator protection. . The bug appeared after the September 22 non-security preview update, KB5124010, or later updates.
Affected users could see the message, "The token passed to the function is invalid." Microsoft's release health notice identifies enterprise-managed computers acting as Remote Desktop hosts as the primary systems affected.
Microsoft states that Windows 11 24H2, 25H2, and 26H2 security standards default to enabling Administrator protection unless an organization changes the policy. Administrators managing other affected versions should check the package tailored for their specific Windows release rather than treating KB5127936 as a universal installer. For computers still running older updates, administrators can temporarily disable the Administrator protection through existing management tools.
The documented workaround involves resetting the "User Account Control Type of Admin Approval Mode" policy through Microsoft Intune or Group Policy. This workaround should be temporary; after deploying the appropriate fixed update, IT teams should verify Remote Desktop access using a non-admin account and review any policy changes made during troubleshooting.
