Remote Desktop connections might fail for non-admin users with error 0xC000000D

What changed

After KB5124010 or a later update, non-admin users can fail to establish Remote Desktop connections to Windows 11 hosts where Administrator protection is enabled; attempts return 0xC000000D and an invalid-token message.

Why it matters

Microsoft security baselines enable Administrator protection by default on Windows 11 24H2, 25H2 and 26H2, so enterprise RDP hosts can become unreachable to standard users; Windows Server is not affected.

Known limitations

• Availability, prerequisites and rollout scope remain authoritative in the linked Microsoft documentation.

Now check

• Identify Windows 11 24H2, 25H2, 26H1 and 26H2 Remote Desktop hosts with Administrator protection enabled and KB5124010 or later
• Test non-admin RDP sign-in and capture error 0xC000000D or the invalid-token message
• If affected, temporarily reset User Account Control Type Of Admin Approval Mode through Intune or Group Policy, then track Microsoft's issue for the permanent Windows update