Description: KB5124010 and later updates can block standard-user Remote Desktop logins. Check host builds, Microsoft’s workaround, and the security cost before changing policies.
Answer: Microsoft confirms that after the September 22, 2026 preview KB5124010 or later Windows 11 updates, non-admin users may get 0xC000000D when connecting to a host with Administrator protection enabled. As of October 18, a mitigation exists but no permanent fix has been announced.
Affected versions and builds
The key device is the remote PC receiving the connection, not necessarily the laptop running the client. The documented combination is an affected Windows 11 update, Administrator protection enabled on the host, and a standard-user account. Enterprise security baselines can enable the feature centrally. This does not mean every Remote Desktop connection fails.
| Remote host | October update | OS build |
|---|---|---|
| Windows 11 24H2 | KB5127648 | 26100.9711 |
| Windows 11 25H2 | KB5127648 | 26200.9711 |
| Windows 11 26H2 | KB5127648 | 26300.9711 |
| Windows 11 26H1 | KB5127646 | 28000.3231 |
The first associated update was KB5124010 on September 22; October is not necessarily when the issue began.
Safe checks
- Record the full error, including 0xC000000D and “The token that was passed to the function is invalid”. Other token errors need a separate diagnosis.
- On the remote host, run
winverand note the Windows version and OS build. Check Settings → Windows Update → Update history for the KB. - Ask IT whether Administrator protection is enabled and whether Intune, Group Policy or a security baseline sets it. Checking the policy does not require changing it.
- If the conditions do not match, check host availability, VPN, RDP permissions and Windows edition first. Windows 11 Home is generally not a supported built-in RDP host.
Official mitigation and security trade-off
Microsoft advises IT administrators, only for affected hosts, to set User Account Control: Configure type of Admin Approval Mode to Legacy Admin Approval Mode (Default) through Intune or Group Policy, restart and retest. Record the previous value, the affected device scope and a plan to restore the safeguard.
This workaround reduces protection. Do not disable all UAC, turn everyday users into administrators, apply arbitrary registry edits or uninstall security patches just to make RDP work. Resetting Windows or deleting profiles can destroy data and workplace configuration without addressing this specific condition.
Fix status and strength of evidence
Microsoft still lists the issue in its October 13 KB5127648 and KB5127646 release notes and promises a future update. The exact internal cause and prevalence are not publicly established. A community report describes Citrix VDA registration failures, but Microsoft has not confirmed that they share the same cause as ordinary RDP failures.
Bottom line
Check the host update, Administrator protection state and standard-user login before taking action. Escalate matching cases to IT for a narrowly scoped mitigation while waiting for a permanent fix.
References (6)
- Microsoft KB5127648 (known issue)
- Microsoft KB5127646 (26H1)
- Microsoft KB5124010 (September preview)
- Microsoft Learn (Administrator protection)
- Microsoft (Remote Desktop requirements)
- Citrix community report (not confirmed as same defect)
Checked October 18, 2026, 09:53 JST. Official documents reviewed; the Citrix link is a community report, not an independent reproduction.
