Microsoft has confirmed that recent Windows updates can cause Remote Desktop connections to fail for some non-admin users. The issue is linked to Administrator protection and can trigger error 0xC000000D, with Windows reporting that “the token that was passed to the function is invalid”.
This is most relevant to business environments using Remote Desktop Services or other managed Remote Desktop hosts, particularly where Microsoft security baselines or Administrator protection have been enabled.
Microsoft is working on a fix. In the meantime, affected organisations should confirm whether Administrator protection is enabled and avoid making broad security changes unless the Remote Desktop failure is actually present.
What is causing Remote Desktop to stop working?
Microsoft says the problem can occur after recent Windows updates when Administrator protection is enabled.
Administrator protection is designed to reduce the security risks associated with administrative privileges. It can require elevated actions to run in a more controlled context rather than giving a user unrestricted administrator rights throughout their session.
On affected systems, however, non-admin users can encounter a Remote Desktop connection failure instead of being authenticated normally.
The error commonly reported is:
0xC000000D – The token that was passed to the function is invalid.
Who is most likely to be affected?
This is not a fault affecting every Windows PC or every Remote Desktop connection.
The issue is most relevant to organisations that use:
- Remote Desktop Services or centrally managed Remote Desktop hosts
- non-admin users connecting to remote Windows systems
- Microsoft security baselines that enable Administrator protection
- Intune or Group Policy to manage Windows security settings
If your staff simply use ordinary local PCs and do not connect to a managed Remote Desktop environment, you may never see this issue.
What should businesses check?
If Remote Desktop started failing after a recent Windows update, check the following before assuming the server, firewall or VPN is at fault:
- Confirm whether the affected user is a standard user rather than a local administrator.
- Check whether Administrator protection is enabled through Intune, Group Policy or a Microsoft security baseline.
- Record the exact error code and message shown during the failed connection.
- Confirm whether administrator accounts can still connect successfully.
- Check whether the failure began immediately after the latest Windows updates were installed.
That combination can help distinguish this Microsoft issue from more common causes such as expired credentials, VPN faults, firewall changes or Remote Desktop licensing problems.
Remote Desktop stopped working after an update?
KES can check whether the problem is linked to Windows updates, Administrator protection, policy settings or the wider Remote Desktop environment.
Is there a workaround?
Microsoft’s current guidance is that affected organisations can work around the issue by disabling Administrator protection until a permanent fix is available.
That can be done through management tools such as Intune or Group Policy, depending on how the environment is configured.
However, this is a security setting, so businesses should not disable it across every device purely as a precaution. The better approach is to confirm that the Remote Desktop problem is present and linked to this issue before changing the policy.
If you use a managed IT provider, they should also document the temporary change so Administrator protection can be re-enabled once Microsoft releases a fix.
Does this mean the latest Windows update should be removed?
Not necessarily.
Removing a cumulative Windows update can also remove important security fixes. That matters particularly this month because Microsoft’s October 2026 security updates include a fix for an actively exploited Windows zero-day.
Unless Microsoft specifically recommends uninstalling an update for your scenario, changing the affected Administrator protection policy is generally a more targeted workaround than rolling back the entire security update.
You can read our separate article on the Microsoft October 2026 security update and actively exploited Windows zero-day for the wider patching context.
How can IT teams confirm the cause?
The most useful test is whether the problem is limited to non-admin users while administrator accounts can still establish a Remote Desktop session.
IT teams should also compare the timing of the failure with recent Windows updates and review the effective policy settings applied to the affected machine or Remote Desktop host.
In a centrally managed environment, this may involve checking Intune policy assignment, Group Policy results or the security baseline applied to the device.
Businesses using outsourced IT support should provide the exact error code rather than simply reporting that “Remote Desktop is down”. Error 0xC000000D is an important clue.
When will Microsoft fix the Remote Desktop problem?
Microsoft has acknowledged the issue and says it is working on a resolution.
At the time of writing, there is no permanent fix published, so affected organisations should use Microsoft’s workaround guidance and monitor the relevant Windows release health information for an update.
If Microsoft releases an out-of-band fix or confirms the problem is resolved in a later cumulative update, the temporary policy change should be reviewed and reversed where appropriate.
Quick answers
Why has Remote Desktop stopped working after a Windows update?
Microsoft says recent Windows updates can cause Remote Desktop failures for some non-admin users when Administrator protection is enabled.
What error does the Remote Desktop problem show?
Affected users may see error 0xC000000D stating that the token passed to the function is invalid.
Does this affect every Remote Desktop user?
No. The issue is mainly associated with managed business environments using Administrator protection.
Should I uninstall the latest Windows update?
Usually not as a first step. Microsoft’s current workaround focuses on Administrator protection rather than removing the entire cumulative update.
Is Microsoft working on a fix?
Yes. Microsoft has confirmed the issue and is working on a resolution.
Sources
