Microsoft: Windows updates may break Remote Desktop with Administrator protection

Microsoft confirmed that Remote Desktop connections may fail with error 0xC000000D after installing the September 2026 KB5124010 preview update or later on Windows 11 24H2/25H2/26H1/26H2. The issue mainly affects enterprise-managed RDP hosts with Administrator protection enabled, which is on by default in Windows security baselines. A temporary workaround is to disable Administrator protection via Intune or Group Policy.

• Error 0xC000000D: "The token that was passed to the function is invalid"
• Affects Windows 11 24H2/25H2/26H1/26H2 after KB5124010
• Administrator protection is enabled by default in security baselines
• Workaround: reset the UAC Type Of Admin Approval Mode policy