Windows updates break Remote Desktop with Admin protection

Microsoft has confirmed that recent Windows 11 updates can stop non-admin users from connecting to devices over Remote Desktop. The problem occurs on machines where the "Administrator protection" security feature is turned on.

The company says the bug affects systems running Windows 11 24H2, 25H2, 26H1 and 26H2. It appears after installing the KB5124010 September 2026 non-security preview update or any later update. Microsoft acknowledged the issue on Tuesday and is still working on a fix.

A feature now on by default for many organizations

Administrator protection first reached Windows 11 24H2 and 25H2 systems in October 2025 through the KB5067036 preview cumulative update. It restricts logged-in users to standard user permissions. When they try to install new apps or change the Windows registry, they must authenticate through Windows Hello, using either a PIN or biometrics.

The feature was optional at first. That has changed. Organizations that rely on Windows security baselines now have it enabled by default once they install the October 2026 Windows security update. Security baselines are Microsoft's recommended configuration settings for hardening Windows, and many enterprises apply them as a starting point for their own policies.

"If your organization uses Windows security baselines, published through the Microsoft Security Compliance Toolkit, Administrator protection is enabled by default in Windows 11, version 24H2, 25H2, and 26H2 security baselines, unless your organization has configured the policy differently," Microsoft said.

This means some IT teams may hit the bug without ever choosing to turn the feature on.

Invalid token errors

Users affected by the problem see their Remote Desktop connection attempts fail with error code 0xC000000D.

"Attempts to connect might fail with error 0xC000000D and display the message, 'The token that was passed to the function is invalid.' This issue primarily affects enterprise-managed remote devices used as Remote Desktop hosts with Administrator protection enabled, regardless of how the feature was enabled," Microsoft explained.

The impact falls mainly on business environments. Devices that act as Remote Desktop hosts in managed networks are the ones at risk, while home users are less likely to run into the error.

Workaround: turn the feature off

Until a permanent fix ships, Microsoft recommends disabling Administrator protection on affected devices. IT admins can do this with whatever policy management tool they already use.

For organizations that use Microsoft Intune or Group Policy, the change involves resetting the "User Account Control Type Of Admin Approval Mode" policy.

The workaround comes at a cost. Turning off Administrator protection removes a layer that limits what logged-in users and any malware running under their account can do without additional authentication. Admins will have to weigh remote access for their staff against that added hardening until Microsoft releases a proper patch.

Not the first Remote Desktop breakage

Remote Desktop has been hit by Windows updates before. In March 2025, Microsoft fixed a similar problem that caused Remote Desktop and RDS connection failures after installing updates released from January 2025 onward.

Last month, the company also had to push emergency out-of-band updates for Windows Server. Those addressed Remote Desktop Services failures triggered by the September 2026 security updates.

The September 2026 release cycle has caused other trouble as well. Microsoft recently resolved an Always On VPN bug tied to the same batch of updates.

Our Take

This bug shows a familiar tension in Windows administration. Microsoft is pushing stronger defaults like Administrator protection, which is a sensible move against credential abuse and unwanted software installs. But when a hardening feature gets switched on through security baselines and then clashes with a core tool like Remote Desktop, admins are left choosing between security and availability.

The timing makes things harder. Many organizations are still deploying the October 2026 Patch Tuesday updates, and the same update is the one that enables the feature by default under the baselines. Teams that rely on Remote Desktop would be wise to test on a small group of hosts before a wide rollout, and to scope any workaround narrowly rather than disabling the protection across the whole estate.

The September and October updates have now produced several separate regressions affecting remote access. That suggests update testing around remote connectivity deserves closer attention, both at Microsoft and inside enterprise patch pipelines. It is worth watching whether Microsoft delivers the fix through a regular cumulative update or another out-of-band release, and whether it adjusts the baseline defaults in the meantime.