Microsoft confirms Windows 11 Remote Desktop failures linked to admin protection
Admin protection in Windows 11 is blocking Remote Desktop for non-admins after recent updates. Microsoft offers a workaround that reduces security.
Key points
- Microsoft attributes Remote Desktop failures on Windows 11 to the Administrator protection feature following recent updates.
- The issue affects versions 24H2 through 26H2 and surfaces primarily for non-administrator users connecting to enterprise hosts.
- The temporary fix requires disabling Administrator protection, which lowers the security baseline for the affected system.
Microsoft confirmed on October 14 that the Administrator protection feature in Windows 11 is causing Remote Desktop connection failures for some business users. The vendor linked these disruptions to recent software updates, creating a conflict between security enforcement and remote access functionality.
The problem emerged after enterprises applied the September 22 preview update KB5124010 and subsequent patches. According to Microsoft documentation, non-administrator accounts attempting to connect to affected hosts encounter error 0xC000000D. This error message states that the token passed to the function is invalid, preventing successful authentication.
How Administrator protection disrupts access
Administrator protection is a security mechanism designed to limit elevated privileges during routine operating system activity. It relies on Windows Hello authentication to authorize administrative actions, such as software installations or system configuration changes. While generally disabled by default, Microsoft includes this feature in its security baselines for Windows 11 versions 24H2, 25H2, and 26H2.
Organizations that have adopted these baselines without overriding the policy are most likely to see this issue. The vendor has identified the configuration conflict but has not explained the underlying technical cause of the token-validation failure. This incident is distinct from a separate Remote Desktop Services regression reported in September 2026.
Which systems and users are affected
The failures primarily impact enterprise-managed Remote Desktop hosts where Administrator protection is active. Users with standard, non-administrator privileges are unable to establish remote sessions, while administrators may not experience the same blockage. The issue spans Windows 11 versions 24H2, 25H2, 26H1, and 26H2, depending on the update path.
The recent rollout of Windows 11 26H2 uses an enablement package for eligible 24H2 and 25H2 devices. Meanwhile, 26H1 follows a separate servicing channel. Microsoft advises administrators to verify the specific Windows version and installed update status on each device before troubleshooting the connection errors.
What should you do?
Microsoft has provided a temporary workaround for organizations experiencing these disruptions. The solution involves disabling the Administrator protection feature on the affected Remote Desktop hosts. This action restores remote access for non-administrator users but temporarily reduces the security safeguards established by the enterprise baseline.
IT teams must weigh the operational need for remote access against the security implications of disabling the protection. Until a permanent fix is released, organizations should monitor their security posture and consider restricting remote access to essential personnel only.
What to do and how to stay safe: Microsoft
- Verify if affected devices are running Windows 11 versions 24H2 through 26H2 with Administrator protection enabled.
- Check for error code 0xC000000D in Remote Desktop logs to confirm the issue matches Microsoft’s reported symptom.
- Consult your enterprise security baseline to understand the risk of disabling Administrator protection on critical hosts.
- Monitor Microsoft’s security update guide for a permanent patch that resolves the conflict without removing security features.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Does this issue affect all Windows 11 versions?
Microsoft states the issue affects Windows 11 versions 24H2, 25H2, 26H1, and 26H2, particularly those with Administrator protection enabled.
Is there a permanent fix for the Remote Desktop failure?
No permanent fix has been confirmed yet. Microsoft has only provided a temporary workaround that involves disabling the Administrator protection feature.
How does this relate to previous Remote Desktop issues?
This failure is distinct from a September 2026 Remote Desktop Services regression. It is specifically linked to the Administrator protection feature and recent updates like KB5124010.
