An administrator opens the remote desktop without trouble. A colleague connects to the same computer and gets an error before their desktop appears. Repeating the password changes nothing.
That account-dependent pattern is a useful clue when investigating RDP Error 0xC000000D. Microsoft has documented a Windows 11 issue involving Administrator protection that can block non-admin connections. Here is how to check whether it matches your situation, review ordinary access permissions, and apply the appropriate workaround.
What This Remote Desktop Error Means
In Microsoft’s documented scenario, non-admin users cannot establish RDP connections to affected hosts with Administrator protection enabled. The accompanying message says, “The token that was passed to the function is invalid.” The problem primarily affects enterprise-managed computers.
Administrator protection controls how Windows grants administrative privileges. Its purpose is to keep users operating with limited rights until elevation is needed and approved.
An administrator’s successful connection helps narrow the investigation. It does not, by itself, prove that this particular Windows issue caused the failure.
Confirm the Windows Update and Host Configuration
Investigate the remote computer receiving the connection, not just the laptop you connect from.
Record its Windows version and build using winver, then review Settings > Windows Update > Update history. Microsoft’s release-health pages identify these originating September 22, 2026 preview updates:
| Windows 11 version | Originating update |
|---|---|
| 24H2, 25H2 and 26H2 | KB5124010 |
| 26H1 | KB5124006 |
Later updates can also be affected. Microsoft lists these Windows 11 client versions as affected, with no Windows Server platforms listed for this specific issue.
Ask IT to confirm whether Administrator protection is effectively enabled. An organization may deploy it through a security baseline, so nobody needs to have switched it on manually.
Status checked October 28, 2026: Microsoft’s release-health guidance describes the issue as mitigated. The October 26 update notes still provide a workaround while a future update is being developed.
Check Remote Desktop Users and Logon Rights
Before changing a security feature, confirm that the account should have remote access.
An administrator should review:
- Remote Desktop Users membership on the destination computer.
- Whether the account or an applicable group has Allow log on through Remote Desktop Services.
- Whether Deny log on through Remote Desktop Services applies through another group.
A deny assignment overrides the corresponding allow assignment. Adding someone to an allowed group therefore may not resolve conflicting policy.
Review the effective configuration, including domain policy, rather than relying solely on a local settings window. Microsoft’s troubleshooting guidance recommends a Group Policy results report for investigating applied logon rights.
Apply Microsoft’s Targeted Workaround
Microsoft’s published mitigation temporarily turns off Administrator protection on affected devices through the organization’s existing policy management method. This changes a security control, so the administrator responsible for those devices should scope and document it.
For Group Policy Management
Open the policy governing the affected computer, expand Computer Configuration > Windows Settings > Security Settings > Local Policies, and select Security Options. Open User Account Control: Configure type of Admin Approval Mode.
Microsoft documents Legacy Admin Approval Mode (Default) as the setting that disables Administrator protection. A restart is required. Coordinate the restart and retain another management route before applying the change.
For Microsoft Intune Management
Reset User Account Control Type Of Admin Approval Mode through the policy controlling the affected devices, following Microsoft’s current mitigation guidance. Check any baseline assigning that setting as well.
After policy application and the required restart, retest the original standard account. Record the temporary exception and review it when Microsoft publishes updated resolution guidance.
Verify Recovery and Preserve Useful Evidence
Use the same client, destination name, and connection route for the follow-up test. This makes the before-and-after comparison more useful.
If access still fails, give IT the error screenshot, attempt time, Windows build, relevant updates, account type, and policy details.
Where auditing is enabled, administrators can inspect Security event 4625 for recorded logon failures. Its failure reason, status, and substatus can help identify another authentication or authorization problem. An event is evidence to interpret alongside the connection details. For another practical example of matching Windows event records to symptoms, see our WMI Provider Host troubleshooting guide.
Conclusion: Confirm the Cause Before Changing Access
RDP Error 0xC000000D deserves a focused investigation when administrators connect and standard users cannot. Check the host’s update history, Administrator protection, and effective logon rights. Share those findings with IT, apply the relevant guidance, and verify the original account can connect again.
Frequently Asked Questions
Why can an administrator connect but a normal user cannot?
The documented Administrator protection issue is one possibility. Missing remote logon rights or conflicting deny policies can also produce account-dependent access problems.
Should I make the affected user an administrator?
Grant the remote access the person actually needs. Administrator membership adds broader privileges and should not become a routine workaround for a standard user’s connection failure.
Will resetting the password fix RDP Error 0xC000000D?
A password reset does not change Administrator protection or remote logon rights. Investigate credentials when the authentication evidence supports that diagnosis.
Has Microsoft permanently fixed this issue?
As checked on October 28, 2026, Microsoft still documents a mitigation and work toward a future update. Check Windows release health for the latest status.
