Do Son 
Microsoft recently updated its release health dashboard to confirm an emerging remote connectivity defect. Specifically, Windows 11 devices installing cumulative update KB5124010 or subsequent releases may reject Remote Desktop connections from non-administrator users. Furthermore, affected systems immediately terminate the handshake with error code 0xC000000D. Consequently, the client interface reports that the incoming authentication token is invalid.
Enterprise Environments Face Primary Impact
According to Microsoft, this anomaly specifically impacts Windows 11 versions 24H2, 25H2, 26H1, and 26H2. Conversely, the company omitted server platforms like Windows Server 2025, confirming that server operating systems remain unaffected.
This failure primarily manifests on enterprise-managed endpoints that actively enforce Administrator Protection. Under normal conditions, Administrator Protection confines users to standard system privileges. When administrative tasks arise, the operating system securely elevates privileges using an isolated administrator profile.
Additionally, applying the Windows Security Baseline automatically enables Administrator Protection by default following the October 2026 security updates. Therefore, enterprise machines enforce this barrier unless IT administrators explicitly disable the configuration through management policies.
Temporary Workaround Disables Administrator Protection
Currently, this connectivity flaw afflicts endpoints running cumulative updates KB5124010 and KB5127648. Therefore, Microsoft offers an interim mitigation to restore immediate operational continuity. System administrators must manually adjust management policies to temporarily deactivate Administrator Protection.
Specifically, IT teams can reset the policy named User Account Control: Behavior of the elevation prompt for administrators. Administrators can configure this adjustment within Microsoft Intune or through local Group Policy objects. However, implementing this modification mandates a full system reboot to take effect. Meanwhile, Microsoft confirmed that engineers are actively preparing a permanent resolution to eliminate the token validation defect.
Support Our Threat Intelligence
Find our tech and OS security coverage helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
