RECENTService advisoryAction required
Remote Desktop connections might fail for non-admin users with error 0xC000000D
Analysis / inference: Certain Windows 11 updates cause RDP failures for non-admin users when Administrator protection is enabled.
- Published
- 13 Oct 2026, 10:13 PM IST
- Updated
- 13 Oct 2026, 10:43 PM IST
- Source
- Windows release health · Limited verification
- Classification
- Microsoft Security
Section 01 · Summary analysis
Post-update behavior prevents non-administrator users from connecting via RDP on hosts featuring Administrator protection, returning a token error.
AI summary / analysis; claims are not independently verified. Check the primary source before acting.
Section 02 · Analysis
SecOps Signal analysisWhy it matters
Non-administrator users are blocked from establishing Remote Desktop connections to enterprise hosts with Administrator protection enabled due to a token validation error.
Operational impact
Disruption to non-administrator remote management and workstation access where Windows security baselines enable Administrator protection by default.
Section 03 · Recommended actions
- Temporarily turn off Administrator protection using Microsoft Intune or Group Policy by resetting the User Account Control Type Of Admin Approval Mode policy.
- Monitor Windows release health for a permanent operating system update addressing the token validation failure.
What to check
- Verify whether enterprise Remote Desktop hosts are running Windows 11 versions 24H2, 25H2, 26H1, or 26H2 with Administrator protection enabled.
- Check for failed RDP login attempts throwing error 0xC000000D and the message "The token that was passed to the function is invalid."
- Inspect Microsoft Intune or Group Policy settings to identify if the User Account Control Type Of Admin Approval Mode policy is active.
Affected scope
ProductsWindows 11 25H2
KBs / artifactsKB5124010, KB5124006