Key points
- Windows 11 versions 24H2 through 26H2 may fail Remote Desktop connections for non-admin users.
- The issue stems from Administrator protection enabled by default in Microsoft security baselines.
- Microsoft provides a workaround to disable the feature but no permanent patch has been confirmed.
Microsoft has identified that a security feature in Windows 11 is blocking Remote Desktop connections for some business users. The problem affects devices running versions 24H2, 25H2, 26H1, and 26H2. According to Microsoft, non-administrator accounts may encounter connection failures when Administrator protection is enabled on the host machine.
In plain English
Windows 11 includes a feature called Administrator protection that limits elevated privileges during routine tasks. It uses Windows Hello to authorize administrative actions like software installations. When this feature is active, it can interfere with Remote Desktop sessions for users who do not have administrator rights. These users may see error code 0xC000000D and a message stating the token passed to the function is invalid.
The background
The issue emerged after recent Windows updates, including the September 22 preview update KB5124010. Microsoft documented the problem on October 14. The feature is generally disabled by default but is enabled in Microsoft’s security baselines for Windows 11 versions 24H2, 25H2, and 26H2 unless organizations override the policy. This configuration is common in enterprise-managed environments.
What changes now
Microsoft has provided a temporary workaround for affected systems. The solution involves disabling Administrator protection on the Remote Desktop hosts. This restores remote access but temporarily reduces a security safeguard. Organizations must weigh the need for remote connectivity against the security benefits of the protection feature. No permanent fix has been confirmed yet.
Who needs to act first
Teams should prioritize updating systems that support critical remote operations. Check which devices have Administrator protection enabled via security baselines. Test the workaround on a small group of devices before wider deployment to ensure no other functions break. Back up current configurations before changing security settings. Monitor user reports for connection errors after applying changes.
What to do and how to stay safe: Microsoft
- Identify which Windows 11 devices have Administrator protection enabled in your environment.
- Test the workaround of disabling the feature on non-critical systems first.
- Monitor Remote Desktop connections for error code 0xC000000D after updates.
- Review security baselines to determine if the feature is required for compliance.
Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Systems
General security guidance from the Patch Review newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which Windows 11 versions are affected by this issue?
Windows 11 versions 24H2, 25H2, 26H1, and 26H2 are affected by the Remote Desktop connection failures.
Is there a permanent fix available?
No permanent fix has been confirmed yet; Microsoft only provides a temporary workaround.
What error code indicates this problem?
Users may see error code 0xC000000D and a message about an invalid token.
