Microsoft fixes Windows 11 Remote Desktop error 0xC000000D for non-admin users on Administrator protection hosts (KB5127936)
Matéria consolidada. Reúne 2 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 2 fontes trouxeram em 31/10/2026 00:05; os links antigos trazem para cá.
Microsoft has fixed a Windows 11 regression that stopped non-admin users from connecting by Remote Desktop to devices with Administrator protection enabled. Connections failed with error 0xC000000D, "The token that was passed to the function is invalid" (gbhackers.com). The bug was introduced by the KB5124010 non-security preview update of September 2026 (September 22, OS build 26200.9550, per gbhackers.com) and affected later updates too (bleepingcomputer.com). Microsoft acknowledged it on October 13, 2026 and marked it resolved on October 28 at 10:00 PT (gbhackers.com). The fix ships in the KB5127936 preview update released October 28, 2026. It mainly affected enterprise-managed Remote Desktop hosts, regardless of how the feature was enabled (bleepingcomputer.com). gbhackers.com stresses that Microsoft documents no CVE, exploitation technique or token-processing security defect, so this is a reliability issue and not a vulnerability. It is the third recent Remote Desktop regression Microsoft has addressed, after a March 2025 fix and emergency out-of-band updates last month for RDS failures caused by the September 2026 security updates (bleepingcomputer.com).
Detalhes técnicos
- The failure comes from an interaction between non-admin Remote Desktop access and Administrator protection, which hardens administrative elevation (gbhackers.com, bleepingcomputer.com).
- Administrator protection has been rolling out since October 2025. It prompts standard users for Windows Hello (PIN or biometric) authentication for registry changes or app installs (bleepingcomputer.com).
- Affected platforms: Windows 11 24H2 and later (bleepingcomputer.com), listed by gbhackers.com as 24H2, 25H2, 26H1 and 26H2. Windows Server is not listed (gbhackers.com).
- The feature is enabled by default in the Windows 11 24H2, 25H2 and 26H2 security baselines distributed via the Security Compliance Toolkit, so managed hosts may have inherited it through centralized deployment (gbhackers.com).
Remediação
- Install KB5127936 (October 28, 2026) or a later cumulative update. Devices on those builds do not need the workaround (gbhackers.com).
- Temporary workaround for systems awaiting the update, or for those waiting for next month's Patch Tuesday: reset the "User Account Control Type Of Admin Approval Mode" policy via Microsoft Intune or Group Policy to disable Administrator protection, then revert once patched (bleepingcomputer.com, gbhackers.com).
Relatos divergentes
- Scope: bleepingcomputer.com says "Windows 11 24H2 and later", while gbhackers.com names 24H2, 25H2, 26H1 and 26H2 explicitly. The two are compatible, and gbhackers.com is more specific and more recent.
- Default enablement: bleepingcomputer.com says Administrator protection is on by default in organizations using Windows security baselines after the October 2026 security update. gbhackers.com says it is on by default in the 24H2, 25H2 and 26H2 baselines from the Security Compliance Toolkit, without tying this to the October update. Neither source is a Microsoft primary source, so the exact baseline timing is unconfirmed.
Linha do tempo
-
Microsoft fixes Windows 11 regression blocking non-admin Remote Desktop connections to Administrator-protection hosts
ler a análise desta fonte ocultar
Microsoft has resolved a Windows 11 regression that prevented non-administrator users from establishing Remote Desktop sessions with devices where Administrator protection is enabled. Affected users saw error 0xC000000D with the message "The token that was passed to the function is invalid." The defect was introduced by KB5124010, the September 22, 2026 non-security preview update (OS build 26200.9550, Windows 11 25H2), and was fixed in KB5127936 released October 28, 2026. Affected platforms include Windows 11 24H2, 25H2, 26H1 and 26H2; Windows Server is not listed. Microsoft documents no CVE, exploitation technique or token-processing security defect — this is a reliability issue, not a vulnerability.
Technical Details
The failure stems from an interaction between non-admin Remote Desktop access and the Administrator protection feature, which hardens administrative elevation. Microsoft opened the investigation on October 13 and marked it resolved October 28 at 10:00 PT. Administrator protection is enabled by default in the Windows 11 24H2, 25H2 and 26H2 security baselines distributed via the Security Compliance Toolkit, so enterprise-managed hosts may have inherited the setting through centralized deployment.
Remediation
Install KB5127936 or a later cumulative update; devices on those builds do not need the workaround. For systems awaiting updates, administrators can temporarily reset the "User Account Control Type Of Admin Approval Mode" policy via Microsoft Intune or Group Policy to disable Administrator protection, reverting once patched.
-
Microsoft fixes Remote Desktop failures (error 0xC000000D) caused by Windows updates with Administrator protection
ler a análise desta fonte ocultar
Microsoft has fixed a known issue where non-admin users could not connect to devices via Remote Desktop when the Administrator protection feature was enabled. The bug, acknowledged on October 13, 2026, caused connections to fail with error 0xC000000D after installing the KB5124010 September 2026 non-security preview update or later updates on Windows 11 24H2 and later. It primarily affected enterprise-managed remote devices used as Remote Desktop hosts, regardless of how the feature was enabled. The fix ships in the KB5127936 preview update released October 28, 2026. This is the third Remote Desktop regression Microsoft has addressed recently, after a March 2025 fix and emergency out-of-band updates last month for RDS failures from the September 2026 security updates.
Technical Details
Administrator protection, rolling out since October 2025 and enabled by default in organizations using Windows security baselines after the October 2026 security update, prompts standard users for Windows Hello (PIN or biometric) authentication for registry changes or app installs. The interaction with this feature broke RDP logons for non-admin users.
Remediation
Install KB5127936 (October 28, 2026) or later. As a temporary workaround for those waiting for next month's Patch Tuesday, IT administrators can disable admin protection by resetting the "User Account Control Type Of Admin Approval Mode" policy via Microsoft Intune or Group Policy.