Windows 11 Remote Desktop Connection Failures Linked to Update

Techrepublic

Windows 11 Remote Desktop Connection Failures Linked to Update

First seen 15 Oct 2026, 11:38 UTC • •30.9

Article Content

1 / 6

Browse articles

ThreatCluster •October 16, 2026 at 09:38 UTC

•Windows 11 update causes Remote Desktop failures for non-admin users.
•Error 0xC000000D indicates an invalid token during connection attempts.
•Temporary workaround involves disabling Administrator protection, impacting security.

A recent Windows 11 update has caused Remote Desktop connection failures for non-administrator users on enterprise-managed devices. Microsoft identified the issue as related to the 'Administrator protection' feature, which limits user permissions and requires Windows Hello authentication. Users attempting to connect may encounter error 0xC000000D, indicating an invalid token. This problem arose after the September 22, 2026, preview update KB5124010 and affects Windows 11 versions 24H2, 25H2, 26H1, and 26H2. Microsoft has provided a temporary workaround that involves disabling the Administrator protection feature, which may compromise security. The company is currently working on a permanent fix for the issue. This situation follows a previous Remote Desktop Services regression that was resolved in September 2026.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated just now How this analysis works

Timeline

2026-09-22

Preview update KB5124010 released

This update is linked to the Remote Desktop connection failures affecting enterprise-managed devices.

2026-10-14

Microsoft confirms Remote Desktop issues

Microsoft acknowledged that non-admin users may experience connection failures after recent updates with Administrator protection enabled.

BleepingComputer

2026-10-15

Workaround published

Microsoft recommends disabling Administrator protection on affected Remote Desktop hosts as a temporary fix.

More articles in this cluster (5)

Threat Graph

3 entities, 2 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Affected Platform (3)

Windows
Windows 11
Windows Hello

Relationships

Windows related to Windows 11
Windows related to Windows Hello

Common questions

Which Windows 11 versions are affected?

The issue affects Windows 11 versions 24H2, 25H2, 26H1, and 26H2.

What is the error message users see?

Users may see error 0xC000000D with the message, 'The token that was passed to the function is invalid.'

What should organizations do in response?

Organizations should consider temporarily disabling Administrator protection on affected systems until a permanent fix is available.

Continue Reading

CISA Mandates Urgent Patching of Five Critical Flaws Exploited by Flax Typhoon The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to patch five critical vulnerabilities by October 11, 2026, following exploitation by the China-linked hacking group Flax Typhoon. The vulnerabilities, added to CISA's Known Exploited Vulnerabilities (KEV) catalog, include…

Critical Zero-Day Exploit Found in BeyondTrust Remote Support BeyondTrust disclosed a critical vulnerability, CVE-2026-102764, in its Remote Support product, exploited by the suspected China-linked group ARMORY CASTLE since August 2026. This flaw, with a CVSS score of 9.3, allows attackers to perform arbitrary file uploads and gain host-level control without requiring…