A Windows 11 security feature designed to protect administrator privileges is preventing some employees from connecting to remote work PCs. The problem has emerged following recent Windows updates, leaving businesses with a security trade-off.
Microsoft confirmed that non-administrator accounts may encounter Remote Desktop failures on enterprise-managed Windows 11 devices with Administrator protection enabled. The company documented the issue on October 14, linking it to the September 22 preview update KB5124010 and subsequent updates. Affected connections may return error 0xC000000D.
Microsoft’s temporary workaround involves disabling Administrator protection on affected Remote Desktop hosts. Restoring remote access therefore means temporarily reducing a security safeguard that may already be enabled through enterprise security baselines.
Why Administrator protection disrupts Remote Desktop
According to Microsoft’s update documentation, the issue affects Windows 11 versions 24H2, 25H2, 26H1 and 26H2. Non-administrator users connecting to affected hosts may see error 0xC000000D and the message, “The token that was passed to the function is invalid.”
The failures primarily affect enterprise-managed Remote Desktop hosts with Administrator protection enabled. Microsoft has identified the affected configuration but has not explained the underlying token-validation failure.
Administrator protection limits elevated privileges during routine Windows activity. It uses Windows Hello authentication to authorize administrative actions, including software installations and system changes.
Although generally disabled by default, the feature is enabled in Microsoft’s security baselines for Windows 11 versions 24H2, 25H2 and 26H2 unless organizations override the policy.
Administrators should check each device’s Windows version and installed updates before troubleshooting. The recent Windows 11 26H2 rollout uses an enablement package for eligible 24H2 and 25H2 PCs, while 26H1 follows a separate servicing path.
The failure differs from a September 2026 Remote Desktop Services regression. Microsoft resolved that earlier problem through emergency updates released September 14, after security patches disrupted remote sessions and sign-ins. The newly documented issue remains unresolved.
Microsoft’s workaround for affected Windows 11 PCs
Microsoft recommends temporarily disabling Administrator protection on affected Remote Desktop hosts through Intune or Group Policy. Administrators should confirm the error code, installed updates and security configuration before making changes.
The workaround involves resetting the “User Account Control: Configure type of Admin Approval Mode” policy to legacy Admin Approval Mode. Microsoft’s policy documentation assigns value 1 to legacy mode and value 2 to Administrator protection. A restart is required.
In Group Policy, the setting appears under Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options. Changing the approval mode does not require disabling User Account Control entirely.
The workaround reduces an endpoint security safeguard, so IT teams should limit changes to affected hosts, test Remote Desktop access afterward and document modified devices. Unaffected systems should retain their existing protections.
Update-related disruptions have also affected device management. A July preview update addressed Intune enrollment failures that incorrectly classified newly provisioned devices as noncompliant.
Microsoft has not announced when a permanent fix will arrive. Until then, administrators should monitor its update guidance, document temporary policy changes and restore Administrator protection after a verified fix becomes available.
Read more: Microsoft’s October 2026 Patch Tuesday updates address an exploited Windows vulnerability and other security flaws, underscoring the need to maintain timely patching even when updates introduce compatibility problems.
Discover more from PressNewsAgency
Subscribe to get the latest posts sent to your email.