Microsoft has recently acknowledged a significant issue affecting Windows 11, where non-administrator users are unable to connect to remote systems when Administrator protection is activated. This complication arose following the non-security preview update KB5124010 released on September 22, 2026, impacting primarily enterprise-managed devices functioning as Remote Desktop hosts.
Understanding the Connection Failure
Users attempting to establish remote connections may encounter the error code 0xC000000D, accompanied by the message, “The token that was passed to the function is invalid.” Microsoft identified the problem on October 13 and has since marked its status as “Mitigated.” While a temporary workaround has been introduced, a permanent solution is still under development.
Impacted Systems and Troubleshooting
The issue specifically affects Windows 11 versions 24H2, 25H2, 26H1, and 26H2, although Windows Server remains unaffected. The problem occurs when Administrator protection is enabled on the remote host, irrespective of the method used to activate the feature. This necessitates careful examination of security settings as part of troubleshooting efforts.
IT support teams are advised to verify installed Windows updates, confirm error reports, and check the status of Administrator protection before altering policies. These steps are crucial for identifying systems corresponding to Microsoft’s problem description.
Addressing the Security Challenge
Administrator protection in Windows 11 is designed to manage system permissions by creating a separate admin token for approved administrative tasks, which is removed upon completion. This mechanism is intended to thwart unauthorized access attempts by malware.
Organizations utilizing Microsoft’s security baselines should thoroughly assess their configurations. The baselines for the affected Windows 11 versions typically enable Administrator protection unless modified. The updated security baseline for version 26H2 also advises testing these settings against organizational requirements.
Temporary Workaround and Future Outlook
For a temporary resolution, Microsoft recommends IT administrators disable Administrator protection on affected Remote Desktop hosts using management tools like Microsoft Intune or Group Policy. However, due to the security implications of this action, it should be restricted to affected systems and documented for future reference.
Previous issues with Remote Desktop credentials do not correlate with this current problem. Microsoft assures that a forthcoming Windows update will offer a permanent fix, with more information to be provided. Organizations are encouraged to stay updated on the developments to ensure seamless remote operations.
