RDP 0xC000000D Token Invalid: Fixed in KB5127936

Standard users locked out of Remote Desktop with error 0xC000000D? The October 28 update fixes it. Here is the patch and the fallback.

Install KB5127936, the October 28, 2026 Windows 11 update, on the remote host to fix Remote Desktop error 0xC000000D. Standard users who connect to a Windows 11 machine with Administrator protection turned on get refused with the message “The token that was passed to the function is invalid.” Admins can still connect, which makes it look like a permissions problem.

A September 2026 Windows 11 preview update broke Remote Desktop sign-in for non-admin users on hosts with Administrator protection enabled, failing with error 0xC000000D. Microsoft fixed it on October 28, 2026 in KB5127936 for versions 25H2 and 26H2, and KB5127653 for 26H1. Hosts that cannot patch yet can temporarily turn Administrator protection off.

Quick Fix: Patch the Host You Connect To

The fix goes on the remote device, the one acting as the Remote Desktop host. Updating the PC you connect from does nothing for this error.

On the host, open Settings, then Windows Update, and install the October 28 update. It is a preview release, so it shows up as an optional update rather than installing on its own. Restart, then have a standard user try the connection again. Windows 11 version 26H1 gets the same fix in KB5127653.

To confirm the build afterward, run winver or this PowerShell line on the host:

# 25H2 should show 26200.9818 or higher, 26H2 26300.9818 or higher, 26H1 28000.3365 or higher
(Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion") | ForEach-Object { "$($_.CurrentBuild).$($_.UBR)" }

Get-HotFix -Id KB5127936

Get-HotFix does not always list every cumulative update, so an empty result is not proof the update is missing. The build number is the reliable check, and Settings, Windows Update, Update history shows the KB by name.

What Happened

Administrator protection is a newer Windows 11 feature that changes how admin rights work: admins run without elevated rights until they approve a task with Windows Hello or credentials. After the September 22, 2026 preview updates, Remote Desktop hosts with the feature turned on started rejecting connections from non-admin accounts. Microsoft says it mostly hits enterprise-managed devices used as Remote Desktop hosts, no matter how the feature was turned on.

This one caught people who never touched the setting. Microsoft’s Windows security baselines for 24H2, 25H2 and 26H2 turn Administrator protection on by default with the October 2026 security update, unless your organization configured the policy differently. Apply the baseline, and standard users lose Remote Desktop to that host.

Windows 11 version	Update that started it	Update that fixes it	Release health status
24H2	KB5124010, build 26100.9550	None listed yet	Mitigated, workaround only
25H2	KB5124010, build 26200.9550	KB5127936, build 26200.9818	Resolved
26H1	KB5124006, build 28000.3086	KB5127653, build 28000.3365	Resolved
26H2	KB5124010, build 26300.9550	KB5127936, build 26300.9818	Resolved

Windows Server is not affected. Microsoft also notes that Administrator protection does not yet apply to Windows 365 Cloud PCs or Azure Virtual Desktop session hosts.

Workaround If You Cannot Patch Yet

This is the only route for 24H2 hosts right now, and a stopgap for any host you cannot update today. Be clear about what it does: it turns off Administrator protection, a security control, on that machine. Use it on the hosts that need Remote Desktop and nowhere else.

In Group Policy, go to Computer Configuration, Windows Settings, Security Settings, Local Policies, Security Options. Set “User Account Control: Configure type of Admin Approval Mode” to “Legacy Admin Approval Mode (Default)”. Microsoft says a restart is required for the change to apply.

In Intune, edit the settings catalog policy that turned the feature on. The setting is “User Account Control Type Of Admin Approval Mode” under Local Policies Security Options. If the setting comes from a security baseline, change it in the baseline, or the baseline will put it back.

Write down every host you change. Once that host has the fix installed, set the policy back to “Admin Approval Mode with Administrator protection” and restart again. A workaround nobody reverses quietly becomes your new security posture.

If That Didn’t Work

If the host is patched, or Administrator protection was never on, the error has a different cause. Start with the account itself. The user needs to be in the local Remote Desktop Users group on the host, or in a group granted “Allow log on through Remote Desktop Services” in User Rights Assignment. A Group Policy that also sets “Deny log on through Remote Desktop Services” wins over both.

For credential prompts that keep rejecting a correct password, see our guide to fixing Remote Desktop credential failures. Sessions that connect and then lock up on Windows Server are a separate problem, covered in our Server 2025 RDP freezing fix.

This month’s other update problems are collected in our October 2026 Patch Tuesday known issues roundup.