Full Report
Microsoft has confirmed that non-admin users may be unable to connect to devices via Remote Desktop after installing recent Windows updates if the "Administrator protection" security feature is enabled. [...]
Analysis Summary
# Vulnerability: Remote Desktop Connection Failure via Administrator Protection
## CVE Details
- **CVE ID**: N/A (Currently identified as a functional regression/software defect resulting from security feature implementation)
- **CVSS Score**: N/A
- **CWE**: N/A
## Affected Systems
- **Products**: Microsoft Windows 11
- **Versions**: Windows 11 versions 24H2, 25H2, 26H1, and 26H2.
- **Configurations**: Systems acting as Remote Desktop hosts where the **"Administrator protection"** security feature is enabled. This is notably prevalent in environments utilizing Windows security baselines (October 2026 update or later).
## Vulnerability Description
Recent Windows updates have introduced a regression where the "Administrator protection" feature interferes with the Remote Desktop Protocol (RDP) authentication stack for non-admin users. Administrator protection is designed to strip administrative privileges from logged-in users, requiring Windows Hello authentication for elevated tasks. However, when enabled, it prevents the proper processing of authentication tokens during RDP sessions. Affected users receive **Error 0xC000000D**: *"The token that was passed to the function is invalid."*
## Exploitation
- **Status**: Not exploited (This is a Denial-of-Service/Functional Failure issue rather than a known exploit vector).
- **Complexity**: N/A
- **Attack Vector**: N/A
## Impact
- **Confidentiality**: None
- **Integrity**: None
- **Availability**: **High** (Prevents remote access to managed enterprise endpoints for non-administrative users).
## Remediation
### Patches
- Microsoft has confirmed they are working on a permanent fix. As of the current report, no specific KB patch has been released to resolve this regression.
### Workarounds
- **Disable Administrator Protection**: IT administrators must temporarily disable the feature via policy management.
- **Group Policy/Intune**: Reset the policy: **"User Account Control Type Of Admin Approval Mode"** to its default or disabled state to restore RDP functionality.
## Detection
- **Indicators of Compromise**: N/A (Focus on operational failure).
- **Detection Methods**:
- Monitor for RDP connection logs containing **Error Code 0xC000000D**.
- Audit systems for the presence of **KB5124010** (September 2026 preview) or subsequent cumulative updates in conjunction with enabled security baselines.
## References
- Microsoft Windows Release Health Dashboard: hxxps[://]learn[.]microsoft[.]com/en-us/windows/release-health/status-windows-11-25h2#5031msgdesc
- Microsoft Security Compliance Toolkit Information: hxxps[://]learn[.]microsoft[.]com/en-us/windows/release-health/windows-message-center#5038
- BleepingComputer Advisory: hxxps[://]www[.]bleepingcomputer[.]com/news/security/microsoft-recent-windows-updates-may-trigger-remote-desktop-failures/