HomeSeptember 2026 patch cycleKB5127648: RDP error 0xC000000D with Admin protection
Call: Known issueCategory: Enterprisefrom 2026-09
KB5127648: RDP error 0xC000000D with Admin protection
Part of September 2026 patch cycle
- Vendor
- Microsoft
- Products
- Windows 11 24H2, Windows 11 25H2, Windows 11 26H1, and Windows 11 26H2
- Published
- · updated
- Status
- Open
Update, Oct 29: fixed in the October preview, except on 24H2. The optional October 28 preview update, KB5127936 (builds 26200.9818 and 26300.9818 for 25H2 and 26H2), fixes this. Its notes say it “addresses an issue that prevented non-admin users from establishing Remote Desktop connections to remote devices with Administrator protection enabled.” Release health lists 26H1’s matching preview as KB5127653 (build 28000.3365), and marks the issue resolved on Oct 28 for those versions. It isn’t resolved on 24H2, which stays at Mitigated. 24H2 doesn’t get previews any more, and Microsoft hasn’t said when the fix will reach it. The same preview also fixes Intune refusing to configure the “Specify thumbprints of certificates representing trusted .rdp publishers” policy. Previews are optional. If you’d rather not pilot one, keep the Administrator protection override on your RDP hosts. Preview fixes usually arrive in the next month’s security update, which is due November 10. Check that release’s notes before removing the override, then test with a non-admin account.
Call: Known issue. Install October anyway, because it fixes an exploited Shell zero-day (CVE-2026-96951). Decide what to do with your RDP hosts before you adopt the October security baselines, since those turn this feature on.
What breaks: Non-admin users can’t open a Remote Desktop session to a host that has Administrator protection turned on. They get 0xC000000D, “The token that was passed to the function is invalid.” Admins get in fine, so the help desk won’t see it when they test.
Who’s hit: Windows 11 24H2, 25H2, 26H1 and 26H2 machines used as RDP hosts with Administrator protection enabled, however it was enabled. It started with the September 22 preview update (KB5124010) and carries through KB5127648 and the October 26 out-of-band KB5134133. Server editions aren’t affected. The trap is the October Windows 11 security baselines. Microsoft turned Administrator protection on by default in them, so a routine baseline refresh can switch it on for you.
Workaround: Turn Administrator protection off on the affected hosts. Reset the “User Account Control: Configure type of Admin Approval Mode” policy in Intune or Group Policy. Microsoft calls that a temporary mitigation and says a fix will come in a future update. If you’ve imported the October baseline, override that one setting for RDP hosts rather than rolling the whole baseline back.
Sources: KB5127936 preview notes (opens in a new tab), Windows 11 release information (opens in a new tab), KB5127648 release notes (opens in a new tab), Windows release health (opens in a new tab), Administrator protection docs (opens in a new tab), Windows message center (opens in a new tab).
Sources
- https://support.microsoft.com/en-us/servicing/os/windows-11/2026/10/kb5127648-windows-11-24h2-25h2-26h2-security-update (opens in a new tab)
- https://learn.microsoft.com/en-us/windows/release-health/status-windows-11-25h2 (opens in a new tab)
- https://learn.microsoft.com/en-us/windows/security/application-security/application-control/administrator-protection/ (opens in a new tab)
- https://learn.microsoft.com/en-us/windows/release-health/windows-message-center (opens in a new tab)
- https://support.microsoft.com/en-us/servicing/os/windows-11/2026/10/kb5127936-windows-11-25h2-26h2-update (opens in a new tab)
- https://learn.microsoft.com/en-us/windows/release-health/windows11-release-information (opens in a new tab)