Windows 11 update breaks Remote Desktop with error 0xC000000D, but Microsoft has a workaround

• Microsoft confirms that Windows 11 updates starting with KB5124010 can prevent non-admin users from connecting to remote PCs with Administrator protection enabled.
• The issue affects Windows 11 versions 24H2, 25H2, and 26H2, with Microsoft also documenting it for 26H1.
• Network administrators can temporarily disable Administrator protection through Group Policy or Microsoft Intune to restore Remote Desktop access.
• A Reddit registry workaround also changes remote UAC filtering, which can weaken security for local administrator accounts.

Windows 11 users are running into a frustrating Remote Desktop problem after installing recent updates. Instead of connecting to a remote computer, some users get the error 0xC000000D with the message, “The token that was passed to the function is invalid.”

Microsoft has acknowledged the issue, which affects non-admin users attempting to connect to remote computers with Administrator Protection enabled. The problem can affect Windows 11 versions 26H2, 25H2, and 24H2 after installing the September 2026 update KB5124010, KB5127648, or later updates.

The company noted that the workaround is to temporarily disable Administrator Protection on affected devices through Group Policy or Microsoft Intune. Microsoft is working on a permanent fix for a future Windows update.

Related

Windows 11 KB5127648 update breaks Wi-Fi authentication, but there’s a fix

It is important to clarify that this isn’t necessarily a general Remote Desktop failure. The problem involves a specific combination of Windows updates, remote logon permissions, and Administrator Protection.

In this guide, I’ll outline the steps to resolve the error 0xC000000D on Windows 11.

How to fix Remote Desktop error 0xC000000D

Microsoft recommends temporarily disabling Administrator Protection on affected remote computers. This is an administrative workaround, not a recommendation to permanently turn off Windows security features.

Before proceeding, confirm that the target PC has an affected update installed and that Administrator Protection is enabled. If the computer belongs to an organization, contact your IT administrator before changing its security configuration.

Group Policy method

To disable Administrator Protection through Group Policy, follow these steps:

1. Open Start on Windows 11.

2. Search for gpedit and click the top result to open the Group Policy Editor.

3. Browse the following path:

   Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options

4. Right-click the “User Account Control: Configure type of Admin Approval Mode” policy and choose the Properties option.

   

5. Choose the “Legacy Admin Approval Mode (default)” option to disable the Administrator Protection and re-enable the legacy security option.

   

6. Click the Apply button.

7. Click the OK button.

8. Restart the computer.

After you complete the steps, the Administrator Protection feature will no longer be enabled on your computer.

Microsoft Intune method

Organizations managing Windows devices through Microsoft Intune can use their existing policy-management workflow to apply the same mitigation to affected computers.

Limit the change to devices experiencing the confirmed problem, record the temporary exception, and restore the intended security configuration when the workaround is no longer necessary.

Should you use the registry fix shared on Reddit?

A Reddit user has proposed an alternative involving two registry changes. The commands modify EnableAdminProtection and LocalAccountTokenFilterPolicy under the system policies Registry key.

You can quickly perform this configuration through PowerShell (admin). For example, this command disables Administrator Protection:

Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" -Name "EnableAdminProtection" -Value 0 -Force

And this command enables the Network Logon Token Filter Policy:

Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" -Name "LocalAccountTokenFilterPolicy" -Value 1 -Force

After running these commands, you may need to restart the computer for the changes to take effect.

These settings serve different purposes, and I wouldn’t recommend applying both automatically.

The first value controls Administrator Protection. The second changes remote UAC token filtering for local administrative accounts in applicable scenarios.

Setting LocalAccountTokenFilterPolicy to 1 can allow remote administrative connections to use an elevated token instead of the filtered token normally provided to local accounts in workgroup environments. Although that can restore access in some situations, it also weakens a security restriction designed to limit remote administrative privileges.

On networks where computers share local administrator passwords, this change can increase the risk of lateral movement. If an attacker compromises one computer, those same credentials could let them access other devices.

If you manage standalone computers, use unique local administrator passwords and consider Windows LAPS where appropriate. Don’t change remote UAC filtering unless you have verified that the change is necessary.

You can read more about this behavior in Microsoft’s documentation on administrative shares and remote access.

What should you do next?

If Remote Desktop stopped working after a recent Windows 11 update, check the installed update, the account type, and whether Administrator Protection is enabled on the remote computer.

If your configuration matches Microsoft’s support page issue, start with its recommended Group Policy or Intune workaround. Avoid permanently weakening remote UAC restrictions to solve a problem that may have a narrower cause.

Microsoft says it’s working on a permanent fix for a future update. Until that fix becomes available, administrators should document temporary policy changes and restore their intended security settings when appropriate.