First confirm the non-admin connection, error and Administrator protection conditions. Then check whether the Windows 11 device has KB5127936 or later; Microsoft’s listed workaround is for affected devices still on an earlier update and is intended for IT administrators.
Check whether the symptom and setup match
Microsoft’s documented issue is a non-admin user unable to establish a Remote Desktop connection to a remote device with Administrator protection enabled, receiving error 0xC000000D and the message “The token that was passed to the function is invalid.” It primarily affects enterprise-managed devices used as Remote Desktop hosts. (Microsoft)
Match the Windows version and update
Microsoft lists Windows 11 versions 24H2, 25H2, 26H1 and 26H2 as affected client platforms; it lists no affected server platform for this issue. The issue was resolved by Windows updates released October 28, 2026 (KB5127936), and later. If the device has KB5127936 or a later update, Microsoft says no workaround is needed for this issue. (Microsoft)
If the device is still on an earlier update
For a device on an update released before October 28 that has the matching failure, Microsoft describes a temporary mitigation for IT administrators: use the organization’s existing policy management method to turn off Administrator protection, resetting the User Account Control Type Of Admin Approval Mode policy in Microsoft Intune or Group Policy. The notice frames this as an option for affected devices, not as a general setting change for every Remote Desktop problem. (Microsoft)
Sources & scope
An AI-assisted explainer checked against the linked primary sources. Source review dates are not necessarily announcement dates.