- Since the optional preview update KB5124010 (September 22, 2026) and the Patch Tuesday update KB5127648 (October 13, 2026), RDP connections from non-administrators fail with 0xC000000D.
- Microsoft confirms the problem for Windows 11 24H2 to 26H2 when Administrator Protection is active on the RDP host.
- The official workaround: temporarily turn off Administrator Protection via Intune or Group Policy. A final fix is still pending.
You patch on Patch Tuesday, go to lunch, and afterwards no regular user can get onto the machine via RDP. That is exactly what quite a few administrators have been reporting since October 13, 2026. The error code is 0xC000000D, and the message reads: “The token passed to the function is invalid”. Here is what Microsoft has confirmed, what is only reader reports, and what you can sensibly do now.
What happened
According to Microsoft, the trigger is the optional, non-security preview update KB5124010 of September 22, 2026 or any later update. With the cumulative update KB5127648 on Patch Tuesday, October 13, 2026, the problem reached many systems. Affected are Windows 11 from 24H2 up to and including 26H2. The problem occurs when Administrator Protection is active.
Administrator Protection is switched on by default in the Windows security baselines (Security Baselines from the Microsoft Security Compliance Toolkit) for 24H2, 25H2 and 26H2, as long as you have not set the policy differently. If you adopted the baselines one to one, you are therefore likely to be affected. According to Microsoft, it mainly hits enterprise-managed devices that serve as a Remote Desktop host, no matter how the feature was enabled.
| Scenario | Affected? | Source |
|---|---|---|
| Windows 11 24H2–26H2 as RDP host, Administrator Protection on, user without admin rights | Yes, error 0xC000000D | Confirmed by Microsoft |
| Same, Administrator Protection off | According to Microsoft, not affected by this error | Confirmed by Microsoft |
| Windows Server 2016, 2019, 2022, 2025 | Not listed as affected | Only Windows 11 is listed |
| Admin shares C$ and ADMIN$ unreachable | Possibly related | Reader reports only |
What only readers report
More observations are piling up in the comments on Born's IT blog. They do not come from Microsoft, so treat them as hints, not as established facts:
- Admin shares: On Windows 11 24H2 clients, C$ and ADMIN$ were no longer reachable from other machines. Locally,
net sharestill listed them.LocalAccountTokenFilterPolicybrought no improvement. - Drive mappings: For one reader, mappings set via Group Policy stopped working after the update.
- Remote maintenance: One reader reports that remote maintenance tools could no longer get access.
- Kerberos message: One reader saw “The encryption type requested is not supported by the KDC”. That is a different error message and not necessarily the same problem.
An NTLMv1 connection was also discussed in the comments. The blog author considers it unlikely, because NTLMv1 would be independent of whether a user is an administrator. What NTLMv1 can still mean for you is covered in our post on the shutdown of NTLMv1 on Windows servers.
Workaround in five steps
Microsoft recommends temporarily disabling Administrator Protection. The policy is called “User Account Control: Configure type of Admin Approval Mode” and is reset in Intune or via Group Policy.
- Narrow down the affected hosts. Check which Windows 11 machines from 24H2 onwards serve as RDP hosts and whether they have the update levels KB5124010 or KB5127648:
Get-HotFix | Where-Object HotFixID -in 'KB5124010','KB5127648' - Read the current state. The value behind the policy is stored in the registry:
reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v TypeOfAdminApprovalMode - Adjust the policy. Reset “User Account Control: Configure type of Admin Approval Mode” in Intune or Group Policy. One reader gives the value 1 as a registry command; that is not from Microsoft, so test it on a single machine first:
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v TypeOfAdminApprovalMode /t REG_DWORD /d 1 /f - Roll out the policy and sign in again. Apply the Group Policy, restart the host, or at least sign in again, until the value is reliably set.
- Test the connection. Sign in via RDP with a user without admin rights. If it works, the error is resolved.
Uninstall the update or use the workaround?
- The security fixes from the October update stay installed.
- It can be rolled out centrally via policy and rolled back again.
- It is the route Microsoft names.
- Administrator Protection is temporarily off on the affected hosts.
- You have to actively undo the exception later.
- It is not guaranteed to fix all follow-on problems, such as those with admin shares.
Microsoft does not advise removing the update, and doing so takes the Patch Tuesday security fixes away again. Some readers report that it helped them. It is not suitable as a permanent solution.
What this means for RDP operators
If you run a Windows machine as remote access for several users, check two things before the next Patch Tuesday: Is Administrator Protection being set on your systems via baselines without you knowing? And is there a test host where updates land a week earlier? A single test host is enough to find such errors before customers or colleagues do.
At the same time: this error is no reason to open RDP up further. If you have the service reachable from the internet, you should already have taken care of the basics from our post RDP exposed to the internet: how to secure access properly. That applies regardless of whether an update is currently causing trouble. If you want to run Windows on a server of your own, you will find the details on the Windows VPS page.
How to check that it worked
- Test sign-in: A user without admin rights signs in via RDP and gets a session instead of 0xC000000D.
- Policy state:
reg queryshows the value you set via Intune or Group Policy. - Admin shares: From a second machine, check whether C$ and ADMIN$ are reachable again, if you use them.
- Reminder list: Note on which hosts you turned the protection off, so you turn it back on later.
Turning off a protection feature is a stopgap with an expiry date, not a state to live in.
You will find the official description in the Windows 11 release health dashboard under “Remote Desktop connections might fail for non-admin users with error 0xC000000D”. Status changes appear there first.
