Windows Updates Trigger Remote Desktop Failures for Non‑Admin Users with Administrator Protection Enabled
What Happened – Microsoft confirmed that recent cumulative updates (KB5124010 and later) can prevent non‑admin users from establishing Remote Desktop (RDP) sessions on Windows 11 24H2/25H2/26H1/26H2 when the “Administrator protection” feature is enabled. The failure returns error 0xC000000D (“The token that was passed to the function is invalid”).
Why It Matters for Trust & Control Assurance
- The incident illustrates a gap in configuration‑change control: a security baseline change unintentionally broke a critical access pathway. Continuous control‑assurance programs must detect, document, and remediate such policy‑driven disruptions.
- It underscores the need for evidence‑driven access‑control monitoring – proving that privileged‑access settings remain aligned with business‑continuity requirements after each update.
Who Is Affected – Enterprises that rely on Windows 11 as a Remote Desktop host, across sectors such as technology, finance, healthcare, and manufacturing.
Recommended Actions
- Review the “User Account Control: Admin Approval Mode” policy in Intune, Group Policy, or your preferred configuration manager.
- Test RDP connectivity on a pilot group after each Windows update before full rollout.
- If required, temporarily disable Administrator protection for RDP hosts while Microsoft finalises a fix.
- Document the policy change and its impact as part of your audit evidence repository.
Technical Notes – The failure is triggered by the KB5124010 September 2026 preview update (and later). The root cause is the interaction between the “Administrator protection” security feature and the RDP authentication token validation routine. No CVE is associated; Microsoft is issuing a temporary workaround via policy reset. Source: BleepingComputer