Troubleshooting Guide: Remote Desktop Error 0xC000000D After Windows Updates

Identify, mitigate, and validate a known Windows 11 issue

Overview

Microsoft has confirmed a Windows 11 issue that can prevent non-administrative users from establishing Remote Desktop connections when Administrator protection is enabled on the remote host.

The issue occurs after installing the September 22, 2026, non-security preview update KB5124010 or later updates. Affected connections may fail with error 0xC000000D and the message:

The token that was passed to the function is invalid.

Microsoft has documented a temporary mitigation. This guide explains how to identify potentially affected devices, verify the relevant configuration, apply the workaround cautiously, and validate the outcome.

Important: This is a troubleshooting procedure for a specific known issue. Do not change security policies unless the symptoms and configuration match the documented scenario.

Symptoms

Users may experience the following:

• Remote Desktop connections fail before the remote session is established.
• The connection returns error 0xC000000D.
• The error message states that the token passed to the function is invalid.
• The remote host runs Windows 11 with Administrator protection enabled.
• The problem started after installing KB5124010 or a later Windows update.

The issue primarily affects enterprise-managed devices acting as Remote Desktop hosts.

Affected Systems

Microsoft's KB5124010 documentation lists Windows 11 versions 24H2, 25H2, and 26H2 as applicable to the update. Contemporary reporting also identifies Windows 11 26H1 as potentially affected.

The issue concerns Remote Desktop hosts with Administrator protection enabled. It does not mean that every device running an affected Windows version will experience the failure. Windows Server is not identified as affected by this specific issue.

Official reference: Microsoft Support — KB5124010 and known issues

Prerequisites

Before changing any configuration, ensure that you have:

• Administrative access to Microsoft Intune or the relevant Group Policy management environment.
• Access to the affected Remote Desktop host, either locally or through an alternative management method.
• Permission to change the applicable security policy.
• A record of the existing configuration and the devices included in the proposed change.
• An approved change procedure if the device is part of a production environment.

Do not depend exclusively on Remote Desktop to manage the affected host. Confirm that another administrative access method is available before making changes.

1Confirm the Reported Error

Ask the affected user to reproduce the issue, if appropriate, and record the exact error message. Confirm that the failure is associated with:

• Error code 0xC000000D.
• The message "The token that was passed to the function is invalid."
• A connection to a Windows 11 Remote Desktop host.

If the error differs, investigate the actual error before applying this workaround.

2Identify the Remote Desktop Host

Identify the computer the user is attempting to connect to. Run winver on that computer to identify its Windows version and release. Record the following information:

• Device name.
• Windows version and OS build.
• Remote Desktop connection target.
• Whether the affected account is a non-administrator account.
• Approximate time when the failure began.

The Windows version alone is not sufficient to establish that the device is affected.

3Verify Installed Windows Updates

On the remote host, open: Settings → Windows Update → Update history

Review the installed quality updates and determine whether KB5124010 or a later update is installed. Record the update KB number and installation date.

Do not uninstall the Windows update solely because the error appeared after installation. First verify the remaining conditions and follow Microsoft's documented mitigation.

4Check Administrator Protection

Review the configuration on the remote host, not just the computer initiating the connection. In Microsoft Intune:

1. Open the Microsoft Intune admin center.
2. Navigate to Devices → Configuration.
3. Review the applicable configuration profiles and Settings Catalog policies.
4. Search for User Account Control Type Of Admin Approval Mode.
5. Determine whether the policy enables Administrator protection.

Also check whether the setting is controlled by another management mechanism, such as Group Policy or a security baseline. A policy assignment alone does not prove that the setting has successfully applied. Where possible, verify the device's reported policy status and effective configuration.

Reference: Microsoft Learn — Administrator protection

5Determine Whether the Known Issue Matches

The issue is a stronger match when all of the following conditions are present:

• The destination is an affected Windows 11 Remote Desktop host.
• KB5124010 or a later update is installed.
• Administrator protection is enabled on the host.
• The affected connection returns error 0xC000000D with the documented token message.

If one or more conditions cannot be confirmed, continue investigating rather than immediately weakening the security configuration.

6Apply Microsoft's Temporary Mitigation

Security warning: Disabling Administrator protection reduces the protection available for privileged administrative operations. Use this workaround only on confirmed affected devices and only for as long as necessary.

Microsoft's documented mitigation is to reset the User Account Control Type Of Admin Approval Mode policy through the existing policy management method.

Option A — Microsoft Intune

1. Open the Microsoft Intune admin center.
2. Identify the configuration profile or profiles that control the affected setting.
3. Confirm the profile's scope and the affected device assignments.

4. Record the current setting and any relevant security baseline requirements.
5. Reset the policy as described in Microsoft's current documentation so that Administrator protection is temporarily turned off.
6. Limit the change to the affected Remote Desktop hosts.
7. Synchronize the affected devices and verify that the intended configuration has applied.

Use the policy's supported reset or unconfigured state where appropriate. Do not assume that selecting Legacy Admin Approval Mode is equivalent to Microsoft's documented reset procedure in every policy configuration. If multiple profiles or management sources control the setting, resolve any conflicts before proceeding.

Option B — Group Policy

If the setting is managed through Group Policy:

1. Identify the applicable Group Policy Object.
2. Verify that it controls the relevant User Account Control setting.
3. Record the existing configuration.
4. Reset the policy according to Microsoft's current instructions.
5. Ensure that the change affects only the intended Remote Desktop hosts.
6. Apply and verify the resulting policy on the affected computers.

Avoid making simultaneous changes in Intune and Group Policy unless you have confirmed how policy precedence and conflicts are handled in your environment.

7Validate the Workaround

After the policy change has been applied:

1. Confirm that the affected device has synchronized with its management service.
2. Verify the effective policy state.
3. Restart the device if required by the resulting configuration or your management procedure.
4. Initiate a new Remote Desktop connection using the affected non-administrator account.
5. Confirm whether the session establishes successfully.
6. Record the result, device name, OS build, policy change, and validation time.

A successful connection indicates that the mitigation may have resolved the reported symptom. It does not independently prove the underlying root cause.

If the connection still fails, restore the appropriate security configuration where possible and continue troubleshooting. Do not repeatedly disable unrelated security settings.

8Monitor and Restore the Security Configuration

Treat the workaround as a temporary exception.

• Document the reason for the change and the devices affected.
• Review the exception periodically.
• Monitor Microsoft's official Windows release health documentation for updates.
• Test any permanent fix on a limited set of devices before wider deployment.
• Re-enable Administrator protection using the approved configuration once the issue is resolved and the change has been validated.
• Verify that Remote Desktop connectivity continues to work after restoring the security setting.

Do not leave the temporary mitigation in place indefinitely without reviewing the security implications.

Troubleshooting Checklist

Before closing the incident, verify the following:

• ☐ The exact error code and message were recorded.
• ☐ The remote host and Windows version were identified.
• ☐ The installed updates were checked.
• ☐ Administrator protection was verified on the remote host.
• ☐ The applicable Intune or Group Policy configuration was identified.
• ☐ The workaround was limited to affected devices.
• ☐ The effective policy state was verified after the change.
• ☐ A new Remote Desktop connection was tested.
• ☐ The security exception was documented.
• ☐ A follow-up plan exists to restore the intended security configuration.

Microsoft Status

Microsoft documented this known issue in its September 2026 update information on October 14, 2026. Its guidance identifies resetting the User Account Control Type Of Admin Approval Mode policy to temporarily turn off Administrator protection as the mitigation.

Microsoft states that it is working on a resolution in a future Windows update. Check the official Microsoft documentation for the latest status before applying this procedure: Microsoft Support — KB5124010

References

1. Microsoft Support — September 22, 2026, KB5124010 Preview and known issues
2. Microsoft Learn — Administrator protection
3. BleepingComputer — Microsoft: Recent Windows updates may trigger Remote Desktop failures

Disclaimer: This guide is an operational troubleshooting reference. Always verify the current Microsoft instructions and assess the security impact before modifying production policies.