MICROSOFT has flagged a remote desktop connectivity issue affecting Windows 11 devices that have installed cumulative updates KB5124010 (and later). The problem causes Remote Desktop connections from non-administrator users to be rejected, with the handshake terminated and the client reporting an invalid authentication token, error code 0xC000000D. The anomaly is most evident on enterprise-managed machines that enforce Administrator Protection.
Affected are Windows 11 versions 24H2, 25H2, 26H1 and 26H2. Windows Server platforms are not impacted, including Windows Server 2025. The underlying behaviour is that Administrator Protection normally elevates privileges through an isolated administrator profile; the security baseline update from October 2026 enables this protection by default on affected systems unless administrators disable it via policy.
As an interim workaround, Microsoft advises temporarily disabling Administrator Protection by adjusting the policy for User Account Control: Behavior of the elevation prompt for administrators. This can be done via Microsoft Intune or local Group Policy objects, with a full system reboot required for the change to take effect. Microsoft is actively working on a permanent fix to resolve the token validation defect so that normal Remote Desktop authentication resumes without manual policy changes.