Remote Desktop Error 0xC000000D After a Windows 11 Update? “The Token That Was Passed to the Function Is Invalid” Fix for Administrator Protection (2026)

You type your password, the Remote Desktop window starts to open, and then it fails with error 0xC000000D and the line “The token that was passed to the function is invalid.”

Nothing is wrong with your password. Microsoft added this exact failure to its Windows 11 release health page on October 13, 2026. It’s tied to one specific security feature on the PC you’re connecting to.

This guide explains who gets hit, how to check whether the feature is on, and how to switch it off safely on a home or small-office PC. It also covers what you give up while it’s off.

Contents

• What causes Remote Desktop error 0xC000000D?
• Which Windows 11 PCs are affected?
• How do you check if Administrator protection is on?
• How to fix it: turn off Administrator protection
• What do you lose by turning it off?
• Does the October 2026 update fix it?
• Tips
• Warnings
• FAQ
• Sources

What causes Remote Desktop error 0xC000000D?

Remote Desktop error 0xC000000D happens when a non-admin user connects to a Windows 11 PC that has Administrator protection enabled and has installed the September 22, 2026 preview update (KB5124010) or any later update, according to Microsoft’s Windows 11 25H2 release health page.

Administrator protection is a newer Windows 11 security feature. It keeps your session at standard-user rights and only hands out a short-lived admin token when you approve a task with Windows Hello. Microsoft’s Administrator protection documentation describes it in detail.

Something in the September changes broke how that token setup handles incoming Remote Desktop sign-ins from standard accounts. The connection gets rejected before your desktop ever loads.

If the error says 0xC000000D but your password and username are right, this is almost certainly the cause.

Which Windows 11 PCs are affected?

The 0xC000000D Remote Desktop bug affects Windows 11 versions 24H2, 25H2, 26H1, and 26H2 acting as the remote host, and Microsoft lists no affected Windows Server versions, per the October 13, 2026 known-issue entry.

All three of these have to be true on the PC you’re connecting to:

1. It installed KB5124010 or later. That’s the September 22, 2026 preview, or any update after it, including the October 13 Patch Tuesday release.
2. Administrator protection is on. It’s off by default for home users.
3. You’re signing in with a standard account. Microsoft’s description is about non-admin users.

Here’s where people get tripped up. Most home PCs never had the feature switched on. But Microsoft’s own note says organizations that use its Windows security baselines got Administrator protection turned on by default with the October 2026 security update. So a work laptop that connected fine last week can start failing this week without anyone changing anything.

When I checked the release health entry, I noticed Microsoft calls this “primarily” an enterprise problem. That’s about how common it is, not a limit on who can hit it. A Windows 11 Pro desktop at home with the toggle on fails the same way.

Built from Microsoft’s Windows 11 release health entry and Administrator protection documentation, checked October 15, 2026.

How do you check if Administrator protection is on?

On a Windows 11 PC, Administrator protection is shown under Account protection in the Windows Security app where that toggle has rolled out, and in Local Security Policy as the “User Account Control: Configure type of Admin Approval Mode” setting, according to Microsoft’s documentation.

Check it on the PC you’re connecting to, not the one you’re connecting from.

1. Open Windows Security. Search for it from Start.
2. Select Account protection. Look for an Administrator protection section. Microsoft says this toggle is still rolling out gradually, so you may not see it.
3. If it’s not there, open Local Security Policy. Press Windows + R, type secpol.msc, and press Enter. This tool comes with Pro, Enterprise, and Education editions.
4. Go to Local Policies, then Security Options.
5. Find “User Account Control: Configure type of Admin Approval Mode.” If it says “Admin Approval Mode with Administrator protection,” the feature is on.

A quicker clue: if installing an app asks for Windows Hello or your PIN instead of a plain Yes/No box, the feature is probably on.

How to fix it: turn off Administrator protection

Microsoft’s only workaround for Remote Desktop error 0xC000000D, as of October 13, 2026, is to temporarily turn off Administrator protection on the affected host by resetting the “User Account Control Type Of Admin Approval Mode” policy, then restarting the device.

Pick the method that matches how the feature was turned on. You’ll need to be at the host PC, or able to sign in to it as an administrator some other way.

Method 1: Windows Security app (home PCs)

1. Open Windows Security on the host PC.
2. Select Account protection.
3. Turn off the Administrator protection toggle.
4. Restart the PC when prompted. Microsoft says a restart is required for the change to take effect.
5. Try the Remote Desktop connection again from the other computer.

Method 2: Local Security Policy (Windows 11 Pro)

1. Run secpol.msc on the host PC.
2. Open Local Policies, then Security Options.
3. Double-click “User Account Control: Configure type of Admin Approval Mode.”
4. Change it to “Legacy Admin Approval Mode (Default)” and click OK.
5. Restart the PC. The setting doesn’t apply until you do.

Method 3: Intune or Group Policy (managed PCs)

1. Find the policy that set it. In Intune it’s in the Settings catalog under Local Policies Security Options. With Group Policy it’s the same Security Options path as above.
2. Reset “User Account Control Type Of Admin Approval Mode” for the affected Remote Desktop hosts only.
3. Check your security baseline. If the baseline sets it, Microsoft says to adjust the baseline, or the setting will just come back.
4. Restart the hosts after the policy applies.

Honestly, if this is a work PC, don’t flip local settings yourself. Send IT the Microsoft known-issue link in the Sources below. The policy will likely override you anyway.

What do you lose by turning it off?

Turning off Administrator protection puts Windows 11 back on the older User Account Control model, where an admin account holds a full admin token for the whole session instead of getting a short-lived one approved with Windows Hello, according to Microsoft’s feature documentation.

In plain terms, malware that runs while you’re signed in has an easier path to admin rights. It’s the same level of protection most Windows PCs have always had, so it isn’t a disaster. But it is a step down.

When I compared the two settings, I found the safest middle ground is narrow. Only turn it off on the PC you actually connect to. Leave it on everywhere else. Then set a reminder to switch it back on once Microsoft ships the fix.

Does the October 2026 update fix it?

No. The October 13, 2026 Windows 11 update, KB5127648 (OS Builds 26300.9711, 26200.9711, and 26100.9711), fixes several other September bugs, but Microsoft lists the 0xC000000D Remote Desktop issue as “Mitigated” and says a fix will come in a future Windows update.

That same update did resolve the AC-3 audio crash and the black-screen-after-sign-in issue on virtual desktops. So it’s still worth installing. It just won’t bring Remote Desktop back on its own.

The next scheduled Windows 11 preview update would normally arrive in late October, with the next Patch Tuesday on November 10, 2026. Microsoft hasn’t said which one will carry the fix. Check the release health page before you turn the feature back on.

If you’re also dealing with other fallout from this month’s update, our guide on the Copilot key remap that disappeared after KB5127648 covers another change it brought.

Tips

• Before you change anything, confirm the error code. Wrong passwords give a different message. Only 0xC000000D with the “token” wording points to this bug.
• Keep a second way into the host. Chrome Remote Desktop or a remote support tool lets you reach it if Remote Desktop stays broken while you’re away.
• Write down which PCs you changed. It makes turning the feature back on later a two-minute job.
• Bookmark Microsoft’s release health page for your Windows version. That’s where the “Resolved” note will show up first.

Warnings

• Don’t uninstall the October security update to get Remote Desktop back. The bug started with the September 22 preview, so rolling back one month won’t help. It would also strip out this month’s security fixes, including a Windows Shell flaw Microsoft says is being actively exploited.
• Don’t turn off Network Level Authentication as a fix. Older forum posts suggest it for “token” errors, but it weakens Remote Desktop security and isn’t Microsoft’s workaround for this bug.
• On managed PCs, a local change may be reversed at the next policy refresh. Fix it at the policy level.
• Remember the restart. Without it, the change does nothing and the error comes back.

FAQ

Does Remote Desktop error 0xC000000D affect Windows 11 Home?

Not as the host. Windows 11 Home can’t accept incoming Remote Desktop connections, so it can’t be the PC that fails. A Home PC can still connect out to an affected Pro or Enterprise PC and see the error.

Will an administrator account still connect over Remote Desktop?

Microsoft describes the bug as affecting non-admin users only. If you have an administrator account on the host PC, signing in with it is worth trying, but changing your daily account to admin just to avoid the bug weakens security.

Do I have to turn Administrator protection back on after the fix?

Yes, if you want its protection back. Windows will not switch it on again for you after a fix arrives, unless a company policy or security baseline manages the setting.

Sources

• Microsoft Learn — Windows 11, version 25H2 known issues and notifications
• Microsoft Learn — Administrator protection
• Microsoft Support — October 13, 2026, KB5127648
• BleepingComputer — Microsoft: Recent Windows updates may trigger Remote Desktop failures (October 14, 2026)

Fact-checked against Microsoft’s Windows release health, Administrator protection documentation, and KB5127648 notes, plus BleepingComputer reporting, as of October 15, 2026. Status may change when Microsoft ships a fix.