Windows 11 RDP 0xC000000D: Fix Non-Admin Logins Blocked by Administrator Protection

Microsoft has officially confirmed a new known issue affecting Windows 11 systems where non-administrator users are blocked from connecting via Remote Desktop after installing recent updates. If your help desk phones have suddenly lit up since October Patch Tuesday with remote staff staring at cryptic authentication errors, you are not dealing with a network outage or a corrupted user profile. Instead, you are looking at a token-handling bug triggered when a specific Windows 11 cumulative update meets Microsoft's newest least-privilege security baselines.

Here is a complete breakdown of why these Remote Desktop connections are failing, which Windows 11 builds and security baselines are caught in the crossfire, and how IT administrators can apply Microsoft's temporary policy workaround without losing track of their enterprise security posture.

The Anatomy of the 0xC000000D Remote Desktop Failure​

On October 14, 2026, Microsoft updated its official support documentation for the September 22, 2026 non-security preview cumulative update—KB5124010—to log a newly confirmed known issue. According to Microsoft Support and reporting by BleepingComputer, installing KB5124010 or subsequent Windows updates (which includes the October 2026 cumulative security updates) can prevent standard, non-admin users from establishing Remote Desktop connections to remote host PCs that have Administrator protection enabled.

When an affected non-admin user tries to initiate an RDP session to one of these machines, the connection fails and throws the following error:

• Error Code: 0xC000000D
• Error Message: "The token that was passed to the function is invalid."

In Windows NT status code parlance, 0xC000000D (STATUS_INVALID_PARAMETER) means a routine received an argument or security token structure it could not validate. Microsoft notes that this bug primarily impacts enterprise-managed remote devices acting as Remote Desktop hosts when Administrator protection is active, regardless of whether the feature was switched on via Group Policy, Microsoft Intune, or local settings.

Which Windows 11 Versions Are Affected?​

While initial reporting from BleepingComputer mentioned Windows 11 versions 24H2, 25H2, 26H1, and 26H2, Microsoft's official KB5124010 support bulletin specifically scopes the update and its known issue to three versions:

Summary: Non-admin RDP logins fail with error 0xC000000D ("The token that was passed to the function is invalid") on Windows 11 24H2, 25H2, and 26H2 hosts running KB5124010 or later updates whenever Administrator protection is enabled.

What Is "Administrator Protection" and Why Did This Happen Now?​

If you haven't manually flipped the switch on Administrator protection in your tenant, you might wonder why this bug is suddenly biting enterprise environments in mid-October. The answer lies in how Microsoft manages its security compliance templates.

How Administrator Protection Works Under the Hood​

According to Microsoft Learn documentation, Administrator protection is a Windows 11 platform security overhaul designed to enforce strict least-privilege operation. Under traditional User Account Control (UAC) Admin Approval Mode, a user in the local Administrators group signs in and receives a split token. While they run with a standard user token by default, the elevated token remains tied to their profile context.

Administrator protection changes that architecture completely:

• Deprivileged Sign-In: Users remain strictly in a deprivileged state during normal operation.
• Profile-Separated Admin Tokens: When an action requires elevation—such as installing an application or modifying the Windows registry—the user must interactively authenticate using Windows Hello (PIN or biometrics) or credentials. Windows then uses a hidden, system-generated, profile-separated user account to mint an isolated admin token.
• Just-in-Time Destruction: That elevated token is handed only to the requesting process and is immediately destroyed the moment the process terminates.

Because this architecture fundamentally alters how Windows generates and validates user and elevation tokens during session creation, any regression in how the operating system passes tokens during a remote logon handshake can cause the session manager to reject the incoming connection outright—resulting in the exact "invalid token" message users are seeing today.

The October 2026 Security Baseline Trap​

By default, on a standard unmanaged Windows 11 installation (Home, Pro, Enterprise, or Education), Administrator protection is off.

However, Microsoft's KB5124010 support advisory and Microsoft Learn documentation highlight a crucial caveat for corporate environments: if your organization deploys Windows security baselines via the Microsoft Security Compliance Toolkit, Administrator protection becomes enabled by default with the October 2026 Windows security update. Specifically, the security baselines for Windows 11 versions 24H2, 25H2, and 26H2 now flip this policy on unless an administrator explicitly configures it otherwise.

Think of it like an automated smart-lock upgrade on an office building: the building management template quietly upgraded the deadbolts on Tuesday morning, and now everyone with a standard employee badge is locked out on the sidewalk because the card reader firmware from late September doesn't recognize their pass.

What Is Not Affected?​

Before server administrators panic, it is worth drawing a clear boundary around this bug. Microsoft Learn explicitly states that Administrator protection is not currently supported on:

• Windows Server editions
• Windows 365 Cloud PCs
• Azure Virtual Desktop (AVD) session hosts

BleepingComputer points out that Microsoft has had a rough history with Remote Desktop stability lately, including a March 2025 RDP/RDS bug mitigated via Known Issue Rollback and a separate September 2026 incident where Patch Tuesday updates caused Remote Desktop Services (RDS) deadlocks on Windows Server 2019, 2022, and 2025 machines, requiring emergency out-of-band patches. However, this current 0xC000000D issue is strictly a client OS bug affecting Windows 11 machines used as direct Remote Desktop hosts (such as jump boxes, lab machines, or dedicated office workstations accessed remotely by standard users).

Summary: While Administrator protection is off by default on standalone Windows 11 PCs, it is enabled by default in the October 2026 Windows Security Baselines for Windows 11 24H2, 25H2, and 26H2. Windows Server, Windows 365, and AVD session hosts do not support Administrator protection and are not the target of this specific bug.

How to Fix Error 0xC000000D: Step-by-Step Mitigation Guide​

Microsoft is currently developing a permanent fix to be delivered in a future Windows update, though no release date has been provided. Notably, Microsoft does not recommend uninstalling KB5124010 or rolling back the October 2026 security updates, as doing so would strip away critical security patches and other stability fixes (including a fix in KB5124010 for a Sysmon file system filter driver crash and Active Directory secure trust relationship drops).

Instead, Microsoft advises IT administrators to temporarily disable Administrator protection on the affected Windows 11 Remote Desktop host machines.

Here is how to apply the workaround across Group Policy, Microsoft Intune, or custom CSP deployments, based on Microsoft Learn's official policy documentation:

Method 1: Group Policy (GPO) or Local Security Policy (secpol.msc)​

1. Open the Group Policy Management Editor for the organizational unit (OU) containing your affected Windows 11 RDP host machines (or run secpol.msc locally on an individual workstation).
2. Navigate to the following path:
   Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options
3. Locate the policy named User Account Control: Configure type of Admin Approval Mode.
4. Change the setting from Admin Approval Mode with Administrator protection back to Legacy Admin Approval Mode (Default).
5. Restart the affected Windows 11 host device. Microsoft's documentation stresses that a system reboot is mandatory for any changes to Administrator protection to take effect.

Method 2: Microsoft Intune (Settings Catalog)​

1. Sign in to the Microsoft Intune admin center and open your device configuration profiles (specifically checking any imported Windows Security Baselines for 24H2, 25H2, or 26H2).
2. In your Settings Catalog policy, navigate to the category Local Policies Security Options.
3. Locate the setting User Account Control Type Of Admin Approval Mode.
4. Reset or change the setting to Legacy Admin Approval Mode.
5. Sync the policy to the security group containing your affected Windows 11 RDP hosts and reboot the target machines.

Method 3: Custom OMA-URI / Policy CSP​

If your organization manages endpoints using custom OMA-URI profiles via the LocalPoliciesSecurityOptions Configuration Service Provider (CSP):

• Target the setting UserAccountControl_TypeOfAdminApprovalMode.
• Ensure the value is set to legacy mode rather than Administrator protection, then initiate a device restart.

Balancing Security Posture Against Operational Continuity​

Should you disable Administrator protection across your entire fleet? Absolutely not.

As veteran sysadmins know, workarounds have a funny way of becoming permanent configurations when nobody tracks them. If you disable Administrator protection globally across your Windows 11 security baseline just to fix a subset of remote desktop hosts, you give up profile-separated, just-in-time elevation on every laptop and workstation where Remote Desktop isn't even used.

Instead, take a surgical approach:

• Scope the exception: Create a dedicated Group Policy Object or Intune exclusion/override profile targeting only the Windows 11 machines that non-admin users actually connect to via Remote Desktop.
• Leave the baseline intact elsewhere: Keep Administrator protection enabled on standard employee laptops and workstations where users log in locally at the console.
• Document the change: Tag the override policy with "KB5124010 RDP Workaround" in your change-management system so your team remembers to revert it back to the hardened baseline once Microsoft ships the permanent patch in a future cumulative update.

Have you encountered the 0xC000000D token error after rolling out the October 2026 baselines or KB5124010 in your environment? Let us know how your rollout is holding up in the WindowsForum community discussions!