A Windows 11 Security Feature Is Blocking Some Remote Desktop Logins After Recent Updates
Microsoft says non-admin users may be unable to connect over Remote Desktop to Windows 11 PCs that have Administrator protection turned on, and its temporary fix is to turn that protection off. Here is how to keep remote access working without leaving those machines exposed.
Here Is How Layered Defenses Help When a Safeguard Has to Step Aside
Sometimes a security feature and a business need collide. Microsoft has confirmed that a Windows 11 protection designed to keep administrator rights out of attackers’ hands is stopping some employees from connecting to their work PCs over Remote Desktop. The temporary fix is to switch that protection off on the affected machines. That is a trade-off worth handling carefully.
The details below come from BleepingComputer’s report on Microsoft’s known-issue notice and TechRepublic’s walkthrough of the workaround.
The feature
Administrator protection keeps signed-in users at standard permissions and asks them to confirm with Windows Hello, a PIN or biometric, before installing apps or changing the registry. It began rolling out with a preview update in October 2025 and is turned on in Microsoft’s Windows 11 security baselines for versions 24H2, 25H2 and 26H2, unless an organization has set the policy differently. BleepingComputer reports that organizations using those baselines get it on by default after the October 2026 security update.
The problem
After installing KB5124010, the September 2026 non-security preview update, or any later update on Windows 11 24H2, 25H2, 26H1 or 26H2, non-administrator users may fail to connect to a Remote Desktop host that has Administrator protection on. The error is 0xC000000D, with the message “The token that was passed to the function is invalid.” Microsoft says it mainly affects enterprise-managed PCs used as Remote Desktop hosts, however the feature was enabled. A permanent fix is promised in a future update, with no date yet.
Microsoft’s workaround
Temporarily turn off Administrator protection on the affected hosts by resetting the “User Account Control: Configure type of Admin Approval Mode” policy through Intune or Group Policy. TechRepublic notes the policy value 1 is legacy Admin Approval Mode and 2 is Administrator protection, that the Group Policy setting lives under Computer Configuration, Windows Settings, Security Settings, Local Policies, Security Options, that a restart is required, and that User Account Control itself stays on.
Why one switch should not decide your risk
Administrator protection is one layer. Turning it off on a few machines is reasonable if the other layers are doing their job. The goal is that no single setting, on or off, decides whether an attacker succeeds.
What this means for your company: the layers, step by step
- Confirm before you change anything. Check that the failing connection shows error 0xC000000D, that the host runs an affected Windows 11 version with KB5124010 or later, and that Administrator protection is actually on. Other Remote Desktop problems have different fixes.
- Scope the workaround narrowly. Apply the policy change only to the Remote Desktop hosts that need it, using a separate group or device filter, and leave Administrator protection on everywhere else.
- Keep Remote Desktop off the open internet. Hosts that lose this protection should be reachable only through a VPN, a remote desktop gateway or a zero-trust access service, never through an exposed port.
- Require multi-factor sign-in for remote access. Whatever identity platform you use, make a second factor mandatory for anyone connecting remotely.
- Trim local administrator rights. With the extra prompt gone, the fewer accounts that hold admin rights on those hosts, the better. Remove standing admin access that nobody needs day to day.
- Watch the exceptions more closely. Make sure endpoint protection is active on those hosts and alert on new administrator accounts, new software installs and changes to security policy.
- Write it down and set a reminder. Record which machines were changed and why, then turn Administrator protection back on once Microsoft ships and you verify the permanent fix.
Microsoft tools such as Intune and Group Policy are the route Microsoft documents here, but the layers above apply whatever management, identity and endpoint products you use.
Need help keeping remote access working without trading away your Windows security settings? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
About The Author
