Microsoft has acknowledged that the rollout of its "Administrator protection" security feature is causing Remote Desktop connection failures for standard users on systems where the feature is enabled. The issue surfaces after deploying recent Windows updates to machines running Windows 11 24H2, 25H2, 26H1, or 26H2.
The Administrator protection capability started deploying through the KB5067036 preview cumulative update in October 2025 for Windows 11 24H2 and 25H2 systems. It is now turned on by default across enterprises that have adopted Windows security baselines following the October 2026 Windows security update.
When active, the feature restricts logged-in users to standard permissions only and requires Windows Hello authentication—using a PIN or biometric—whenever users attempt to install applications or modify Windows registry settings.
Microsoft disclosed on Tuesday that Remote Desktop attempts fail with error 0xC000000D following installation of the KB5124010 September 2026 non-security preview update or any subsequent updates on affected Windows versions. According to the company, "Attempts to connect might fail with error 0xC000000D and display the message, 'The token that was passed to the function is invalid.' This issue primarily affects enterprise-managed remote devices used as Remote Desktop hosts with Administrator protection enabled, regardless of how the feature was enabled."
The company also noted that "If your organization uses Windows security baselines, published through the Microsoft Security Compliance Toolkit, Administrator protection is enabled by default in Windows 11, version 24H2, 25H2, and 26H2 security baselines, unless your organization has configured the policy differently."
While Microsoft continues investigating a permanent resolution, the vendor has provided a temporary workaround for IT administrators. The solution involves disabling Administrator protection through the policy management tool of choice, such as Microsoft Intune or Group Policy, by resetting the "User Account Control Type Of Admin Approval Mode" policy.
This is not the first time Administrator protection has caused connectivity issues. In March 2025, Microsoft resolved a comparable problem that disrupted Remote Desktop and RDS connections following Windows updates deployed since January 2025. Additionally, the company released emergency out-of-band updates last month to address Remote Desktop Services failures on Windows Server devices caused by the September 2026 security updates.