Windows 11 26H2: Remote Desktop fails for non-admin users (0xC000000D)
Summary
After the September 2026 preview update, non-admin users might be unable to connect via Remote Desktop to devices that have Administrator protection enabled. Microsoft resolved the issue with updates released on 2026-10-28. For Windows 11 24H2 the release health page still shows the issue as mitigated, with a fix planned for a future update.
Symptoms
The connection attempt fails with error 0xC000000D and the message "The token that was passed to the function is invalid." It mainly affects enterprise-managed Remote Desktop hosts with Administrator protection enabled, however the feature was enabled.
Affected
- Windows 11, versions 26H2, 26H1, 25H2 and 24H2 (client only; no server versions)
- Originating updates: KB5124010 (26H2, 25H2, 24H2; 2026-09-22) and KB5124006 (26H1; 2026-09-22), and later updates
- Remote Desktop hosts with Administrator protection enabled
- Devices configured with the Windows security baselines for 24H2, 25H2 and 26H2, where Administrator protection is enabled by default unless the policy was configured differently
Workaround
- Use your existing policy management method (Microsoft Intune or Group Policy) to temporarily turn off Administrator protection.
- Reset the policy "User Account Control Type Of Admin Approval Mode".
- No workaround is needed once the update from 2026-10-28 or later is installed.
Fix
Resolved by the updates released on 2026-10-28: KB5127936 (26H2, 25H2) and KB5127653 (26H1), and later updates. For 24H2 the vendor page (status Mitigated) does not yet name a fixing update.
Recommendation
Install the latest security update on the affected Remote Desktop hosts. Until then, use the policy workaround only where necessary, as it turns off Administrator protection, and re-enable the protection after patching. For 24H2 devices, check the release health page for a fixing update.
Reports from the community and trade media
Reports from forums, Q&A sites, Reddit and trade media – linked only, without the names of the authors; the vendor’s statement is authoritative.
- KB5124006 Windows 11 26H1 update Vendor · support.microsoft.com, 19 Oct 2026
- Windows 11 KB5127648 issues: should you install the update News · techdows.com, 25 Oct 2026
- Microsoft known issues News · manageengine.com, 19 Oct 2026
- Windows 11 26H2 release health status Vendor · learn.microsoft.com, 28 Oct 2026
- KB5124006 NinjaOne KB catalog News · ninjaone.com, 31 Oct 2026
- Windows 11 26H1 release health Vendor · learn.microsoft.com, 28 Oct 2026
- KB5127648 Windows 11 security update Vendor · support.microsoft.com, 14 Oct 2026
Sources
- Windows release health: Windows 11, Version 26H2 Vendor · learn.microsoft.com
- Windows release health: Windows 11, Version 26H1 Vendor · learn.microsoft.com
- Windows release health: Windows 11, Version 25H2 Vendor · learn.microsoft.com
- Windows release health: Windows 11, Version 24H2 Vendor · learn.microsoft.com
- KB5127936 Vendor · support.microsoft.com
- KB5127653 Vendor · support.microsoft.com
- Administrator protection on Windows 11 Vendor · techcommunity.microsoft.com
- KB5124010 Vendor · support.microsoft.com
Compiled from the sources listed and translated with AI (Claude); status and dates come from the vendor. The vendor’s statements are authoritative. Updated 1 Nov 2026, 15:48.
Where the information comes from
We continuously read the vendors’ official sources, community reports and trade media and summarise them in our own words, with a link to the source:
- Microsoft: Windows release health (Windows 10/11, Server 2016 to 2025), Windows message center, known issues of Microsoft 365 Apps (Outlook, Excel, Word, PowerPoint), Edge, Intune, Autopilot, Windows 365 and Entra Connect, Microsoft KB articles with timelines, Exchange and Windows IT Pro blogs, optionally Microsoft 365 service health and message center
- other vendors: Veeam KB, Citrix (known issues), Ubuntu and Debian (regressions), Broadcom (VMware), Fortinet, Cisco, Mozilla, Let’s Encrypt
- community (title, short excerpt and link only, without the names of the authors): Microsoft Q&A, Microsoft Tech Community (discussions), Veeam R&D Forums, Eleven Forum
- targeted web research with AI (Claude), e.g. on the updates of the month – this also finds discussions on Reddit and in forums; such entries are labelled as community reports until the vendor confirms them
- early warning from trade media (title and link only): Born’s Tech and Windows World, BleepingComputer, AskWoody, Windows Latest, Windows Central, gHacks, The Windows Club, Deskmodder, Dr. Windows, WindowsArea, Frankys Web, heise online
Summary and translation with AI (Claude by Anthropic) – without any data of visitors.
Affected? We can help.
We check whether your systems are affected, apply workarounds properly and plan for dated changes in good time.