Description: A confirmed Windows 11 issue can block non-admin Remote Desktop users after KB5124010 or later updates. Check the host's Administrator protection setting, affected versions and Microsoft's temporary mitigation before changing anything.
If Remote Desktop started failing with 0xC000000D after a Windows 11 update, Microsoft has documented a specific case: a non-administrator connecting to a remote PC with Administrator protection enabled. The issue began with the September 22, 2026 preview update KB5124010 and persists in later updates. As of October 16, Microsoft lists it as mitigated, with a permanent fix still in development.
Match the symptoms before troubleshooting
The connection can fail with the message “The token that was passed to the function is invalid.” This does not, by itself, prove that the user's password is wrong. The relevant configuration is on the remote host, not necessarily the laptop initiating the connection.
Microsoft lists Windows 11 24H2, 25H2, 26H1 and 26H2 as affected. The scenario primarily involves enterprise-managed hosts. Organizations using Microsoft's security baselines may have Administrator protection enabled by default unless they changed the policy. An unrelated RDP timeout or a different error code needs separate investigation.
Safe checks in order
- Save the exact error code, message and time of failure; avoid guessing from a generic “can't connect” screen.
- Ask someone with access to the host to run Win + R →
winverand check Settings → Windows Update → Update history for KB5124010 or later updates. - Have IT check whether Administrator protection is enabled on that host and whether non-admin accounts are the ones affected.
- Send the host name, Windows version and error to the help desk. This is enough to start a focused investigation without collecting passwords or changing security controls.
Workaround versus fix
Microsoft's documented mitigation is for IT administrators: temporarily turn off Administrator protection on affected hosts using their existing Intune or Group Policy management process, resetting the User Account Control Type Of Admin Approval Mode policy. Because that reduces a security protection, the organization should assess the risk, scope the exception and plan to restore it. End users should not apply an improvised registry change.
The October 13 security update KB5127648 fixes other Windows issues but does not resolve this Remote Desktop failure according to Microsoft's current release-health record. Avoid uninstalling security updates, wiping the PC or resetting accounts as a first response; none is Microsoft's recommended mitigation for this case.
Bottom line
The useful diagnostic combination is KB5124010 or later + protected remote host + non-admin RDP account + 0xC000000D. Confirm those four details, then let IT decide whether the temporary policy mitigation is appropriate while Microsoft prepares a permanent update.
References (4)
- Microsoft, Windows 11 version 26H2 release health (updated October 15, 2026): https://learn.microsoft.com/en-us/windows/release-health/status-windows-11-26H2
- Microsoft, October 13, 2026 — KB5127648 release notes: https://support.microsoft.com/help/5127648
- Microsoft, Administrator protection documentation: https://learn.microsoft.com/en-us/windows/security/application-security/application-control/administrator-protection/
- Verified: 2026-10-16 22:54 JST.
