Microsoft documents a Remote Desktop failure for non-admin users connecting to hosts with Administrator protection enabled: connections may fail with error 0xC000000D and the message “The token that was passed to the function is invalid.”
Per Windows release health (Windows 11, version 25H2), the issue is tied to the September non-security preview KB5124010 (and later updates) and is marked Resolved KB5127936 (resolved 28 October 2026 PT). The KB5127936 preview notes (28 Oct; builds 26300.9818 / 26200.9818) list the same fix under Remote Desktop (Known issue) Fixed.
Confirmed points
- Primarily affects enterprise-managed Remote Desktop hosts with Administrator protection enabled (regardless of how the feature was turned on)
- Windows security baselines (Security Compliance Toolkit) often enable this protection by default on Windows 11 24H2 / 25H2 / 26H2 unless the organization changed the policy
- After KB5127936 (or a later update from 28 Oct 2026+), Microsoft says you do not need the workaround
Temporary workaround (IT only, before the fix)
If the device does not yet have KB5127936 and you still hit the issue, Microsoft documents an IT-admin mitigation: temporarily turn off Administrator protection via your existing policy path (reset the User Account Control: Type of Admin Approval Mode policy in Intune or Group Policy). See Microsoft’s Administrator protection documentation. Do not change this on a corporate PC without IT approval; do not uninstall security updates.
This topic is distinct from the Always On VPN (Connecting / port already in use) article in the same cycle.
Sources
- Microsoft — KB5127936 Preview (Remote Desktop Fixed)
- Microsoft Learn — Remote Desktop 0xC000000D / Administrator protection (Resolved KB5127936)
Question: has your org seen 0xC000000D on non-admin Remote Desktop sessions with Administrator protection, and did KB5127936 clear it once deployed?