Windows 11 error 0xC000000D: Remote Desktop fix is in KB5127936, Microsoft says

Microsoft says the Windows 11 bug that blocked non-admin users from Remote Desktop connections, with error 0xC000000D and the message "The token that was passed to the function is invalid", is fixed in the optional update KB5127936 released on 28 October 2026 and in later updates. The bug hit remote PCs that have Administrator protection switched on, which is the default in Microsoft's Windows security baselines once the October 2026 security update is installed. If you manage such machines, this is the page to check before you spend a day blaming the network.

Key points

• Error 0xC000000D ("The token that was passed to the function is invalid") appears when a non-admin user opens a Remote Desktop session to a Windows 11 PC with Administrator protection enabled.
• Microsoft traces the problem to the September 2026 non-security preview update KB5124010 (OS build 26200.9550, released 22 September 2026) and later updates; it opened the known issue on 13 October 2026.
• Affected: Windows 11 versions 24H2, 25H2, 26H1 and 26H2 as the remote host. Microsoft lists no Windows Server versions.
• Fixed: Microsoft marked the issue resolved on 28 October 2026 in KB5127936 (builds 26300.9818 and 26200.9818 for 26H2 and 25H2) "and later".
• Workaround before the fix: an administrator resets the "User Account Control Type Of Admin Approval Mode" policy in Intune or Group Policy, which turns Administrator protection off.

What to do

Check whether you are affected. You are affected if all of these are true: the PC you connect to runs Windows 11 24H2, 25H2, 26H1 or 26H2; it has KB5124010 or a later update; Administrator protection is enabled on it; and the person connecting is a standard (non-admin) user. Microsoft says the problem mainly hits enterprise-managed devices used as Remote Desktop hosts, regardless of how Administrator protection was turned on. The error shows on the connecting side as 0xC000000D.

Fix it. Install Windows updates released on or after 28 October 2026. The first one to carry the fix is KB5127936, a non-security preview update. It is offered as an optional update: Settings > Windows Update > Advanced options > Optional updates. Microsoft's KB page says it is not delivered through Windows Update for Business or WSUS channels, where the changes will arrive in a future security update; admins can import the standalone package from the Microsoft Update Catalog manually. The page lists a prerequisite checkpoint update, KB5043080, for the catalog package, and for 24H2 and 25H2 a Windows update released on or after 10 June 2025 (such as KB5060842) plus the latest servicing stack update.

If you cannot update yet. Microsoft's workaround is for IT administrators to turn Administrator protection off on the affected devices through the tool they already use, by resetting the "User Account Control Type Of Admin Approval Mode" policy in Microsoft Intune or Group Policy. In Group Policy the setting is called "User Account Control: Configure type of Admin Approval Mode", and Microsoft's documentation says to set it back to "Legacy Admin Approval Mode (Default)" and restart the device. Turning the feature off lowers the protection it provides, so treat it as temporary and switch it back on after the update.

Check the policy sources. If your organisation applies Microsoft's security baselines, the baseline for Windows 11 24H2, 25H2 and 26H2 turns Administrator protection on by default after the October 2026 security update, unless you configured the policy differently. Review that setting in your baseline before rolling it out to machines used as Remote Desktop hosts.

What happened

Microsoft acknowledged the bug on 13 October 2026 in its Windows 11 release health pages, the same day as its October security update. The notice said that after installing KB5124010 or later updates, non-admin users might be unable to establish Remote Desktop connections to devices with Administrator protection enabled. BleepingComputer reported it on 14 October under the headline that recent Windows updates may trigger Remote Desktop failures, and said Microsoft was still working on a fix at that point.

Two weeks later, on 28 October 2026, Microsoft changed the status to Resolved. Its release health entry says the issue "was resolved by Windows updates released October 28, 2026 (KB5127936), and later", and that anyone who installs that update or a newer one does not need the workaround. BleepingComputer covered the fix on 29 October.

The KB5127936 support page lists the fix in plain terms: it "addresses an issue that prevented non-admin users from establishing Remote Desktop connections to remote devices with Administrator protection enabled." The same release also fixes a second Remote Desktop problem, in which the "Specify thumbprints of certificates representing trusted .rdp publishers" policy could not be configured through Intune. We covered the rest of that update, including the new right-click menu and the Cloud rebuild option, in our KB5127936 article.

Background: what Administrator protection does

Administrator protection is a Windows 11 security feature built on least privilege. When you sign in you get a deprivileged token. When something needs admin rights, Windows asks you to approve it with Windows Hello, then uses a hidden, system-generated, profile-separated account to create an isolated admin token that is destroyed when the process ends. Microsoft's documentation says this stops malware from silently gaining admin rights. Installing software and changing system settings such as the time or the registry are among the actions that trigger the prompt.

Microsoft's documentation says the feature became available with the August 2026 preview update KB5120998, is off by default, and can be enabled with Intune's Settings Catalog, the LocalPoliciesSecurityOptions CSP, Group Policy, or (still in preview for Insiders) the Windows Security app. It also lists situations where Microsoft says not to enable it: Windows 365 Cloud PCs, Azure Virtual Desktop session hosts, devices that need Hyper-V, setups where apps share files across profiles, and devices managed with LAPS. The same troubleshooting list includes this Remote Desktop error and the workaround above.

Remote logons are a known edge of the design. Microsoft documents two policies that control whether domain users in the local Administrators group get elevated tokens on remote logon when Administrator protection is on; by default they log on without elevation. The 0xC000000D bug is about non-admin users, which is a different path, but it shows that remote sign-in is where the new token model is most likely to collide with existing tooling.

Remote Desktop has had similar update regressions before. BleepingComputer notes that a comparable problem after updates released since January 2025 was fixed in March 2025, and that in September 2026 Microsoft shipped out-of-band updates for Remote Desktop Services failures on Windows Server caused by the September security updates. Those are separate incidents from this one; the release health entry for this bug lists no Server versions.

How the timeline fits together

The dates matter if you are working out which of your machines saw the bug:

• 22 September 2026: KB5124010, the September non-security preview update (OS build 26200.9550), the first update Microsoft lists as the origin.
• 13 October 2026: Microsoft's October security update, KB5127648, and the day the Remote Desktop issue was opened in release health.
• 28 October 2026: KB5127936 released; issue marked Resolved at 10:00 Pacific time.

Because Microsoft names KB5124010 as the origin "and later updates", machines on the October security update were exposed too, but only when the three conditions in "What to do" held. Home PCs that never enabled Administrator protection, and machines where everyone who connects is an administrator, were not in the affected group according to Microsoft's description.

What it means

For IT teams, the lesson is practical. The feature that caused the trouble is a security improvement that Microsoft's own baselines now switch on, so a baseline refresh can enable it on a fleet without anyone deciding to. If you use Remote Desktop to reach shared lab PCs, jump hosts or support machines, test a non-admin sign-in after each baseline or update change, and keep the Intune or Group Policy change that disables the feature ready as a rollback.

For people running one or two PCs, the fix is simpler: if you did not enable Administrator protection yourself, you very likely never saw this. If you did, install the optional update or wait for the next security update.

For Microsoft, this is another Remote Desktop regression tied to a monthly update (BleepingComputer points to earlier ones in March 2025 and September 2026). Fifteen days passed between the acknowledgment on 13 October and the resolution on 28 October, and the fix first shipped in an optional preview update that managed fleets do not receive through their usual update channels.

What we don't know yet

• Microsoft has not said which monthly security update will carry the fix to Windows Update for Business and WSUS customers. KB5127936's page says only that the changes will appear in a future security update. We do not know the exact release date or KB number.
• Microsoft has not published the technical cause beyond the error text. The release health entry describes the symptom and the condition, not the code path.
• It is not stated how many devices are affected. The condition, enterprise-managed hosts with Administrator protection, suggests a limited group, but Microsoft gives no figures.
• BleepingComputer reports the feature's rollout beginning with a preview update in October 2025, while Microsoft's own documentation says it became available with KB5120998 in August 2026. We have followed Microsoft's documentation and cannot reconcile the two dates.

What to watch next

Watch the Windows 11 release health page for your version for any reopening of the issue, and the next monthly security update's notes for the Remote Desktop line. If you manage Azure Virtual Desktop or Windows 365, remember that Microsoft says Administrator protection is not supported there, so do not enable it on those session hosts.

Sources

• Microsoft: Windows 11, version 25H2 known issues and notifications (primary source, entry "Remote Desktop connections might fail for non-admin users with error 0xC000000D")
• Microsoft Support: KB5127936
• Microsoft Learn: Administrator protection
• BleepingComputer: Microsoft: Recent Windows updates may trigger Remote Desktop failures (14 October 2026)
• BleepingComputer: Microsoft fixes Remote Desktop failures caused by recent Windows updates (29 October 2026)