Windows 11 Remote Desktop Error 0xC000000D: Causes, Official Workaround, and Safe Fixes

Remote Desktop error 0xC000000D can stop a user from signing in to a Windows 11 work PC even when the computer is online, the Remote Desktop service is running, and the username and password are correct. If it began after a recent Windows update and the affected user is not a local administrator, the problem may be a newly acknowledged Microsoft issue rather than a broken network connection.

The verified answer as of October 16, 2026: Microsoft says that installing the September 22, 2026 preview update KB5124010 or a later update can cause Remote Desktop sign-in failures for non-administrator users connecting to Windows 11 hosts with Administrator protection enabled. Affected connections can report 0xC000000D and the message “The token that was passed to the function is invalid.” Microsoft recommends an IT-controlled, temporary change to Administrator protection policy while it works on a permanent solution. The company has not yet announced a generally available permanent fix for this specific error in the cited October 13 update notice. Microsoft’s October 13 update and known issue.

Do not start by disabling all User Account Control (UAC), turning off the Windows firewall, opening Remote Desktop to the entire internet, or uninstalling the latest security patch. Microsoft’s documented mitigation concerns the type of Admin Approval Mode used by Administrator protection, not an instruction to switch off Windows security wholesale. On a managed PC, contact IT before editing a security baseline.

Last reviewed: October 16, 2026. This guide distinguishes the newly reported 0xC000000D bug from the different Remote Desktop Services outage that Microsoft fixed in September. Interface labels and affected-release status may change after another Windows update.

Quick diagnosis: does your failure match the confirmed Microsoft bug?

Before changing your PC, match your symptoms to Microsoft’s definition. An identical hexadecimal code can appear in different circumstances, so the code alone is not a complete diagnosis.

Most useful first distinction: Did the client reach the login/authentication stage and return the exact token error, or did it fail before contacting the remote host? If it cannot find or contact the host, the Administrator protection mitigation is unlikely to be your starting point.

What Microsoft officially confirmed in October 2026

The KB5127648 release notes were updated on October 14, 2026 to list this Remote Desktop known issue. The September preview KB5124010 release notes now include the same warning. The originating preview was released September 22; the public issue acknowledgment came later.

Microsoft’s description is specific: non-admin users may fail to establish Remote Desktop connections to enterprise-managed remote Windows devices with Administrator protection enabled. It does not say all Remote Desktop installations fail, every updated PC is affected, or every user receives this error. Organizational security baselines are particularly relevant because Administrator protection may be enabled by default in security baseline configurations for Windows 11 24H2, 25H2, and 26H2, unless policy has been customized.

The official workaround targets the Remote Desktop host, not necessarily the laptop or desktop initiating the connection. A company may deploy the mitigation through Microsoft Intune or Group Policy. Microsoft states that it is working on a future update to address the defect. A separate KB released in September fixed a different Remote Desktop Services stability incident; it should not be described as the permanent repair for 0xC000000D.

Affected Windows versions and updates

Important servicing nuance: Windows 11 24H2 Home and Pro reached their end-of-updates date on October 13, 2026. That separate lifecycle event does not itself diagnose this RDP problem. For upgrade planning, read our Windows 11 24H2 support-end guide, but do not deploy an OS upgrade as an untested substitute for a targeted enterprise workaround.

Why the token can be rejected even when credentials are correct

Remote Desktop sign-in uses identity and security-token processing in addition to basic network connectivity. Administrator protection is designed to keep administrative privileges restricted until an authorized elevation request occurs, using a just-in-time permission model. On a configured Windows 11 host, a change in the security and token-handling path can interfere with how an incoming non-admin session is established.

The displayed phrase “The token that was passed to the function is invalid” describes a failed security-related operation. It does not mean the user has necessarily typed the wrong password, that their Microsoft account is compromised, or that they should delete their Windows profile. Microsoft’s release note identifies the combination of certain updates, a non-admin account, and Administrator protection on the host. It does not provide a public low-level root-cause analysis that would justify inventing a more specific mechanism.

The distinction matters for IT support: if an admin connects successfully but a standard user gets 0xC000000D, repeatedly clearing credential caches or resetting the whole PC may waste time while increasing risk. First establish whether the feature is enabled on the target machine and whether the current update matches Microsoft’s known-issue window. For the security model and supported settings, see Administrator protection in Windows 11.

Step 1: Capture the precise error and identify the Remote Desktop host

Collect evidence before any reboot or policy change. A short incident record can prevent the wrong endpoint from being reconfigured.

1. On the connecting device, open Remote Desktop Connection (mstsc.exe) or the Remote Desktop client approved by your organization.
2. Record the full error message, hexadecimal code, and approximate time. If possible, take a screenshot that does not expose a password, recovery code, or sensitive company data.
3. Record the target host name or approved server address; distinguish this from the PC you are currently sitting at.
4. Note whether the target is an ordinary Windows 11 PC, a Windows Server session host, an Azure Virtual Desktop host, or a Windows 365 Cloud PC. Product and deployment differences matter.
5. Ask whether several standard users are affected while an authorized administrative account still connects; don’t conduct unauthorized credential tests.
6. Identify whether the problem began immediately after a Windows patch, a new baseline deployment, an Intune policy change, or another infrastructure event.

A user who works through a company VPN, RDP gateway, or zero-trust access service should record which layer reports the error. A gateway authentication failure can look like a Windows sign-in problem. If the failure appears in the gateway before the Windows logon prompt, involve the team managing that gateway.

What to tell IT in the first support ticket

A useful initial report includes: the exact message 0xC000000D, the target PC name, Windows version and most recent cumulative update if known, whether your account is non-admin, whether other users can connect, the time of failure, VPN or gateway involved, and whether the host has Administrator protection enabled. This makes it easier to distinguish Microsoft’s October issue from routine connectivity problems.

Step 2: Confirm Windows version and the relevant updates on the remote host

If you or an approved administrator can access the remote host locally or through another authorized management channel, inspect its update history. It is not enough to check the Windows version on the client PC.

1. On the affected host, press Windows + R, enter winver, and note whether it runs Windows 11 24H2, 25H2, or 26H2.
2. Open Settings > Windows Update > Update history and inspect Quality updates for KB5124010 and subsequent packages, including the October 13 cumulative update KB5127648.
3. Record the OS build and recent successful installation dates. A cumulative update may replace earlier files, so not seeing the original preview in one inventory screen does not exclude the bug.
4. If the system is managed through Intune, Configuration Manager, or an RMM tool, consult the organization’s authoritative deployment inventory.
5. Compare the first observed RDP failure with the installation and policy deployment timeline. Document exceptions and differences across devices.

For a read-only command-line inventory, an admin may run Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 15 in PowerShell. This output is a supporting inventory, not an exhaustive list of every update component or feature deployment. The graphical Update history and management-console records can provide additional context.

Which update should you remove?

Do not immediately remove a security update. Microsoft’s documented first mitigation is a policy adjustment managed by IT. Removing a cumulative update may eliminate unrelated security protections, does not necessarily remove every triggering condition, and may be prohibited by enterprise policy. If an organization evaluates rollback, it should follow its formal change-control and security-exception process, using the documented update’s uninstall support and a tested recovery plan.

Step 3: Check whether Administrator protection is enabled

This is the pivotal step for the known bug. Administrator protection is not the same setting as Windows Defender Firewall, Remote Desktop enabled, or the standard Windows UAC slider. It is a newer Windows 11 security feature that modifies how administrative elevation is handled.

On a managed PC, the effective setting may come from Microsoft Intune, Group Policy, a security baseline, or a local security setting. An end user may see a gray switch because their organization controls it. Do not try to defeat management controls.

Check through Local Security Policy or Group Policy

An authorized administrator can open secpol.msc on a supported edition, or edit the relevant domain Group Policy Object through the Group Policy Management Console. Navigate to:

Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options.

Look for User Account Control: Configure type of Admin Approval Mode. On builds where Administrator protection is available, the options distinguish legacy Admin Approval Mode from Admin Approval Mode with Administrator protection. This setting is different from User Account Control: Run all administrators in Admin Approval Mode. Disabling the latter is an unnecessarily broad change that reduces Windows security, and is not the Microsoft workaround for this bug.

The Microsoft policy documentation describes UserAccountControl_TypeOfAdminApprovalMode, where 1 = legacy Admin Approval Mode and 2 = Admin Approval Mode with Administrator protection. Policy support depends on the Windows edition, build, and rollout status; use the UI or management capability available on the actual host rather than assuming every endpoint has this policy.

Check from Intune

In Microsoft Intune admin center, admins can inspect a Windows device’s assigned Settings catalog and security baseline policies. Microsoft’s configuration guide groups two relevant settings under Local Policies Security Options:

• User Account Control Type Of Admin Approval Mode — selects the legacy mode or Administrator protection mode.
• User Account Control Behavior Of The Elevation Prompt For Administrator Protection — determines elevation prompt behavior when the feature is active.

Check the device’s effective configuration and policy conflicts, not simply whether a profile exists somewhere in the tenant. If a baseline enables Administrator protection, a local adjustment may be reversed by management on the next synchronization. Identify the winning management policy before testing.

Step 4: Apply Microsoft’s official temporary workaround safely

This section is for authorized IT administrators. In Microsoft’s October 13 update notice, the temporary mitigation is to turn off Administrator protection on affected Remote Desktop hosts through your existing policy management method, by resetting User Account Control: Configure type of Admin Approval Mode to the non-Administrator-protection mode. It is a targeted workaround until Microsoft releases an official repair.

Managed Group Policy procedure

1. Obtain your organization’s change approval and identify a small test group of affected Windows 11 host computers.
2. Export or document the relevant existing Group Policy settings, OU scope, and baseline assignments so they can be restored later.
3. Open the Group Policy Management Console and edit a controlled GPO applying to the chosen affected hosts, not every company computer by default.
4. Under Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options, locate User Account Control: Configure type of Admin Approval Mode.
5. Select the legacy Admin Approval Mode option rather than Admin Approval Mode with Administrator protection. Do not disable all UAC, change administrator group membership, or remove password requirements.
6. Apply the policy to the scoped test hosts. Follow your organization’s normal Group Policy update procedure; a restart is required for this policy change to take effect according to Microsoft.
7. After restarting, ask a previously affected, authorized non-admin user to connect again. Record the result and verify other security controls remain active.
8. If successful, expand only to affected hosts under a documented temporary exception, with an owner and a date to review Microsoft’s fixed-release status.

Security trade-off: The temporary configuration removes a defense intended to limit administrative privilege exposure. Microsoft documents it specifically as a mitigation; an organization should weigh the business need to restore RDP against the security consequences. Restrict device scope and duration, retain endpoint monitoring, and plan to restore Administrator protection when a verified fix is deployed.

Intune policy procedure

1. Identify the affected device group and its effective User Account Control Type Of Admin Approval Mode setting.
2. Open the corresponding policy in Intune or create an appropriately scoped exception following security-team procedures.
3. Configure the setting to use legacy Admin Approval Mode rather than Administrator protection. Microsoft’s CSP documentation labels the values 1 and 2, respectively, for supported devices.
4. Assign the revised policy to the intended host devices, review conflicts, and confirm the change reached the endpoints.
5. Restart the devices through approved maintenance processes; schedule around user work and unsaved sessions.
6. Test RDP using a normal non-admin user account and document the exact error before and after.
7. Track the exception and restore the stronger mode after Microsoft publishes and your team validates a fix.

If Intune reports a conflict, an underlying security baseline or second Settings catalog policy may still require Administrator protection. Resolve policy precedence in Intune rather than guessing from the local switch. The full feature configuration is explained in Microsoft Learn’s Administrator protection guide.

How to roll back the workaround after a fix

Record what the configuration was before the mitigation. When Microsoft identifies a cumulative update that explicitly fixes this 0xC000000D issue, pilot that update on a representative host, restore the prior Administrator protection setting, reboot, and test both standard-user RDP access and normal admin elevation. Then remove the temporary policy exception. Do not use an unrelated September RDS patch as proof this October issue is resolved.

Step 5: Verify Remote Desktop permissions without elevating users

Even if the symptom resembles Microsoft’s known issue, remote sign-in still requires the account to be authorized for RDP. Microsoft explains that a user must have access to the host, appropriate permissions, and a permitted network path in its Enable Remote Desktop documentation.

On the remote host, under Settings > System > Remote Desktop, confirm the feature is enabled and review the Remote Desktop users list, subject to company policy. Members of the local Administrators group may have access automatically; non-admin users generally need explicit authorization through Remote Desktop Users or organizational group policy. Adding a user to Remote Desktop Users is not the same thing as adding them to Administrators.

For centrally managed devices, also verify that the user has the Allow log on through Remote Desktop Services user right and is not affected by Deny log on through Remote Desktop Services. Deny rights can override other grants. The organization’s baseline may intentionally limit RDP access; no user should be added merely to make the error disappear without authorization.

If an employee receives a different access-denied message or was never entitled to RDP, the fix is to resolve permissions through IT—not to change the Administrator protection policy automatically.

Step 6: Check connectivity only when the error points to a network failure

The specific token-error pattern is not primarily a port problem. Nevertheless, if the machine cannot be reached at all, start with connectivity rather than editing security-token settings. Microsoft provides a standard PowerShell connectivity test in its Remote Desktop troubleshooting guide.

1. From an authorized device on the correct corporate network or VPN, verify that the host name resolves to the expected machine.
2. Try the host’s correct internal name or IP address only if permitted by the organization’s network policy.
3. In PowerShell, run Test-NetConnection -ComputerName pc-name.example.com -Port 3389 -InformationLevel Detailed, replacing the example name with your actual authorized host.
4. If TcpTestSucceeded is True, the tested TCP path is reachable. It does not prove that authentication will succeed, that RDP is authorized, or that the target host is free of the token bug.
5. If TcpTestSucceeded is False, consult your VPN, firewall, RD Gateway, DNS, Remote Desktop service, and endpoint status before changing Administrator protection.

Port 3389 is the normal direct RDP listener, but some organizations use an RD Gateway, alternate port, broker, or zero-trust connector. A failed direct-port test is not conclusive in those designs. Never expose TCP 3389 directly to the public internet simply to test a workaround. Favor approved VPN, gateway, identity, and MFA controls.

Remote Desktop service and Windows firewall checks

If basic connectivity fails, an approved administrator can inspect whether Remote Desktop is enabled, the host is awake, and inbound access is permitted through the appropriate firewall profile. Microsoft’s documentation describes the Remote Desktop rules within Windows Defender Firewall with Advanced Security. Do not disable the entire firewall as a diagnostic shortcut, and do not create broad public-network allow rules on an enterprise laptop. Any rule changes should follow IT’s existing access design.

If the remote machine is Windows 11 Home, it normally cannot act as an incoming Remote Desktop host, although it can connect outward as an RDP client. That is an edition limitation, not the new 0xC000000D Administrator protection defect. Microsoft’s Remote Desktop prerequisites document the supported host editions.

Step 7: Collect useful diagnostics for IT support

A reproducible incident report is far more valuable than screenshots of generic fix-it utilities. Collect information that links the failure code, remote host, Windows build, and effective Administrator protection policy.

Windows Event Viewer can contain relevant entries under Windows Logs > Security and Applications and Services Logs > Microsoft > Windows, including TerminalServices-related operational logs. Availability, log names, and useful event details vary by edition, enabled auditing, and architecture. Correlate timestamps with a single approved test and redact user names, IP addresses, and other sensitive data before sharing publicly. An event entry by itself should not be presented as a documented signature of Microsoft’s issue unless Microsoft publishes that mapping.

Export Group Policy results

If the remote host is domain-managed and you have permission, run Command Prompt as administrator on that host and use gpresult /h C:\Temp\rdp-policy.html after ensuring the C:\Temp folder exists. Review the resulting HTML report for the effective device policies and the winning GPO. If the output path is unavailable, use an approved writable folder. The Microsoft Group Policy troubleshooting documentation explains how to interpret resultant policy reports.

Record whether an Intune or domain policy overwrites local settings, and whether a reboot occurred after the approved change. A change that did not apply cannot establish whether the mitigation works.

Don’t confuse the October 0xC000000D error with September’s RDS instability

In September 2026, Microsoft acknowledged a separate Remote Desktop Services issue causing connection and sign-in failures, hangs, and failures in management tools after a security update. Microsoft released out-of-band updates on September 14 to address that earlier issue. For Windows 11 version 26H1, Microsoft’s documentation points to KB5129194. Other Windows releases and Server editions had their own applicable packages.

By contrast, the 0xC000000D problem currently discussed in Microsoft’s October 14 known-issue notice occurs with non-admin RDP users, Administrator protection, and the KB5124010-or-later update window. The official interim fix is a targeted security-policy change, while Microsoft continues work on a permanent update.

See Microsoft’s Windows 11 26H1 release-health history for the earlier incident. Always confirm your exact OS and update KB before using any historical fix.

What to do if you do not administer the Windows 11 host

If the remote computer belongs to your employer, university, customer, or managed service provider, do not edit a security policy, install a remote-access replacement, ask someone for their admin password, or use a personal cloud service to bypass corporate access controls.

• Open a support request containing the exact 0xC000000D message, the remote host name, time, and whether this began after an update.
• Ask IT whether the host is included in the Windows 11 Administrator protection baseline and whether non-admin RDP is failing for other users.
• Use only an existing, company-approved alternate access method while support staff investigate—for example, an approved web application, remote management service, or temporary local-access workflow.
• If you have urgent unsaved work on the host, explain this before anyone reboots it as part of policy remediation.
• Confirm with IT when service is restored. Do not keep a personal workaround in place after the security team removes the exception.

For a small business without a dedicated IT team, a qualified Windows administrator or managed service provider can apply the same controlled diagnosis and mitigation. They should document rollback steps, backup critical files, and restrict any policy exception to known affected machines.

Troubleshooting when the official workaround does not resolve the error

If non-admin RDP still fails after an approved policy change, do not keep making security weaker. Work through the following evidence-based sequence.

1. Confirm the change actually applied to the host. Check Intune reporting or Group Policy results and confirm the required restart occurred.
2. Recheck the exact error. If the new message is now about credentials, permission, network connectivity, or session capacity, you may have uncovered a separate issue.
3. Test more than one approved non-admin account only with IT approval. This helps determine whether the failure belongs to one identity or the entire host population.
4. Review remote logon permissions. Inspect Remote Desktop Users membership, relevant user rights, and deny assignments. Do not automatically turn users into administrators.
5. Review gateway and VPN behavior. Confirm that a newly required MFA step, gateway policy, or network segment is not independently blocking the connection.
6. Inspect security and TerminalServices events. Correlate specific attempts with the host timeline, recent policy changes, and the client dialog.
7. Check current Microsoft known-issue status. A new cumulative update may supersede the workaround. Test fixed builds on a small device group first.
8. Escalate to Microsoft or your organization’s Microsoft support channel with build, KB information, event evidence, and a description of the mitigation tested.

You can also compare a failing host to an unaffected peer with the same approved access design. Differences in Windows build, deployment ring, security baseline, OU or group policy, and local group membership can reveal the actual cause without arbitrary system modifications.

If only one user is affected

Look at that user’s RDP entitlement, account status, group membership, logon-right restrictions, authentication path, and whether the account is a non-admin in the affected host. Check whether other non-admin accounts fail with the same token error, not merely any error. Avoid deleting the user’s profile, disabling MFA, or telling them to create a new privileged account as a first response.

If every user is affected

An across-the-board outage deserves a broader investigation of host availability, RDS services, network path, gateway policy, update state, and service health. It is not a close match to the non-admin-specific pattern in the new notice. Use the transport test, event logs, and official general Remote Desktop troubleshooting as appropriate. If it follows a September security update and includes RDS hangs, consider whether the separate September RDS incident applies.

If the error happens only over VPN

First ask whether the RDP connection is made directly to the host or through a gateway or broker. Check whether DNS, VPN split routing, network access controls, device compliance, and MFA behavior changed. A VPN-only difference points more toward access path or authentication infrastructure, although a host-side Windows bug can coexist. Do not open RDP ports to the internet as a test. Follow approved remote-work access procedures.

Why common internet “fixes” can make things worse

Search results for Remote Desktop errors often recommend sweeping changes that are not warranted for this specific Microsoft-confirmed condition. Some weaken important defenses; others do not target the cause at all.

Security recommendations while a temporary workaround is in place

If business continuity requires temporarily switching from Administrator protection to legacy Admin Approval Mode on selected hosts, treat it as a time-limited security exception, not a new permanent baseline. Preserve least-privilege account roles, Defender and endpoint protections, firewall restrictions, credential hygiene, and monitoring. Keep the remote-access path within your organization’s authorized network architecture and maintain logs appropriate for your privacy and retention policies.

Test the mitigation first on a representative group. Track which devices received it, who approved it, why it was necessary, the date applied, and the conditions under which it will be reversed. Ensure the change does not silently turn off after a policy conflict or unexpectedly spread to unrelated computers. Once Microsoft’s fixed build is verified, restore the original stronger setting and retest the same standard-user workflow.

Never ask employees to share passwords or verification codes for troubleshooting. Microsoft support personnel and legitimate help desks do not need a user’s password pasted into a support ticket to review policy configuration or read ordinary diagnostic logs.

How to monitor Microsoft’s permanent fix

As of the October 16, 2026 documentation check, the relevant Microsoft update notice says a permanent solution is still being developed. Because the status could change quickly, avoid putting an undated claim such as “fixed by KB…” into support instructions until Microsoft actually updates the issue entry.

Bookmark and recheck these official pages:

• October 13, 2026 — KB5127648 Windows 11 release notes and known issues.
• September 22, 2026 — KB5124010 preview release notes.
• Administrator protection configuration and security implications.
• Type of Admin Approval Mode policy and values.
• Microsoft’s Remote Desktop setup and access prerequisites.

An organization should document any new build that claims to resolve this specific code and condition, install it in a test ring, verify standard-user remote sign-in, and then roll back its temporary security exception. “Install the latest update” is sound general maintenance but is not a substitute for verifying the listed issue’s resolution status.

A practical decision checklist for users and administrators

If you are an employee: Capture the exact 0xC000000D error, host name and time; report the possibility of a KB5124010-or-later Administrator protection conflict; ask IT about approved temporary access. Do not change security policies yourself.

If you administer a managed Windows 11 host: Match the non-admin symptom and affected update window; check effective Administrator protection policy; pilot Microsoft’s narrowly scoped mitigation via Group Policy or Intune; restart and test; preserve security controls; track the exception until a verified fixed build is available.

If your computer shows a different RDP error: Start with host availability, address/DNS, VPN/gateway, authorized RDP access, port and firewall configuration, or the specific message that Windows displays. Avoid applying an unrelated security-policy workaround based solely on the words “Remote Desktop not working.”

Bottom line: Error 0xC000000D after Windows 11’s September preview or later updates is a documented sign-in issue under specific Administrator protection conditions, not a universal Remote Desktop outage. The safest route is to verify the exact pattern, apply Microsoft’s controlled temporary policy change only on affected hosts, and restore the stronger security setting once the permanent fix has been confirmed.

Official references and further reading

1. Microsoft Support — October 13, 2026 KB5127648 release notes and Remote Desktop known issue.
2. Microsoft Support — September 22, 2026 KB5124010 preview and known issue.
3. Microsoft Learn — Administrator protection in Windows 11.
4. Microsoft Learn — LocalPoliciesSecurityOptions CSP, including Type of Admin Approval Mode.
5. Microsoft Learn — User Account Control settings and configuration.
6. Microsoft Learn — Enable Remote Desktop on a Windows PC.
7. Microsoft Learn — Remote Desktop cannot connect: network and port diagnostics.
8. Microsoft Learn — General Remote Desktop connection troubleshooting.
9. Microsoft Learn — Applying Group Policy troubleshooting guidance.
10. Microsoft Learn — Earlier September 2026 RDS issue and its resolution.