Microsoft warns Windows updates can break Remote Desktop logins

What is going wrong

Microsoft says recent Windows updates can cause Remote Desktop connections to fail for non-admin users when the Administrator protection security feature is enabled. Affected connections can return error 0xC000000D with the message: “The token that was passed to the function is invalid.” ¹

The issue affects enterprise-managed Remote Desktop hosts running Windows 11 versions 24H2, 25H2, 26H1 and 26H2. Microsoft lists the September 2026 preview update KB5124010 and later updates as the trigger in its release-health notice. ¹

Why Administrator protection matters

Administrator protection is designed to keep users on standard permissions until an action genuinely needs elevated access. When the feature is active, Windows uses Windows Hello authentication, such as a PIN or biometric check, for elevation instead of leaving users with permanent administrator rights. ²

Microsoft says the problem is especially relevant to organisations using Windows security baselines, where Administrator protection is enabled by default for supported Windows 11 versions unless the policy is changed. ¹

The temporary workaround

Microsoft's current mitigation is to disable Administrator protection through the organisation's policy-management method. That can mean adjusting the relevant User Account Control policy in Microsoft Intune or Group Policy while the company works on a fuller fix. ¹

The workaround reduces the protection that triggered the failure, so IT administrators should treat it as a temporary compatibility measure rather than a permanent security recommendation.

What businesses should check

Administrators seeing the error should first identify whether the affected machines are Remote Desktop hosts, whether Administrator protection is enabled and which Windows update was installed most recently. Microsoft marks the issue as mitigated in its release-health tracker, but the notice still documents the policy workaround for affected systems. ¹

Our opinion

This is the awkward sort of Windows bug that turns a sensible security improvement into an operational headache. Administrator protection is meant to reduce unnecessary privilege, yet a Remote Desktop failure can leave IT teams choosing between a broken support path and temporarily weakening that safeguard.

The practical answer is to apply Microsoft's mitigation narrowly, document the exception and restore the protection as soon as an update resolves the compatibility problem. ¹