Sunday, October 18, 2026
IT BusinessDigest
Get the Daily Brief
In Brief

Windows 11 Remote Desktop error 0xC000000D: which hosts are hit

The October security baselines switch on Administrator protection. Windows Server, Azure Virtual Desktop session hosts and Cloud PCs are not affected.

Morgan Reid Security and infrastructure writer · · 2 min read
A server room with network cabinets

Microsoft confirmed on October 13 that non-admin users may be unable to open Remote Desktop sessions to Windows 11 machines that have Administrator protection turned on. The connection fails with error 0xC000000D, and Windows reports that the token it was given is invalid. The bug arrived with the September 22 preview update, KB5124010, and Microsoft says later updates carry it too, so the October 13 security update, KB5127648, does not help. It affects Windows 11 24H2, 25H2, 26H1 and 26H2. There is no fix yet.

Administrator protection is off by default. But Microsoft's Windows security baselines for 24H2, 25H2 and 26H2 turn it on with the October security update, unless your policy says otherwise. A company that applies the baselines can end up with it on without a separate decision.

Which hosts can break

Only Windows 11 PCs acting as Remote Desktop hosts, mainly company-managed ones. Microsoft lists no affected Windows Server versions. Its Administrator protection page says the feature does not yet run on Windows Server, Azure Virtual Desktop session hosts or Windows 365 Cloud PCs, so those are outside this bug.

This is a different problem from September's Remote Desktop Services failure, which Microsoft fixed with update KB5129195 on September 14.

What IT teams should do

  1. Confirm the error code before changing anything, and check whether the host has Administrator protection enabled.
  2. On affected hosts only, reset the User Account Control policy named "Type Of Admin Approval Mode" (in Intune it sits under Local Policies Security Options), as Microsoft advises. Group Policy works too. TechRepublic notes this returns the machine to legacy Admin Approval Mode, so UAC does not need to be switched off.
  3. Restart the host afterward, as TechRepublic advises. Microsoft says turning the feature on needs a reboot.
  4. Keep a list of the hosts you changed and turn the feature back on once Microsoft ships the fix.
  5. Our October Patch Tuesday guide covers the security fixes in the same update, and our end-of-support roundup lists what Microsoft stopped patching this week.

Sources