Remote Desktop error 0xC000000D: the token passed to the function is invalid (fix)

Does this match your problem?

Microsoft’s release health pages describe the issue as Remote Desktop connections failing for non-admin users. It fits if all of these are true:

• The PC you’re connecting to (the host) runs Windows 11 and has Administrator protection turned on, often through a company security baseline.
• The account you sign in with isn’t an administrator on that PC.
• It started after the host installed the September 22, 2026 preview update or a later update.

Microsoft says administrators aren’t affected, hosts without Administrator protection aren’t affected, and Windows Server isn’t affected. It mainly hits company-managed PCs used as Remote Desktop hosts. Administrator protection is on by default in Microsoft’s Windows 11 security baselines for 24H2, 25H2 and 26H2, which is why it can be on without anyone remembering turning it on. If an admin account connects fine and a standard account doesn’t, this is almost certainly the cause.

Status by Windows version

The fix depends on the version of the remote PC. Run winver on it to check.

Host version	Status (as of November 5, 2026)	What to do
Windows 11 25H2	Resolved	Install KB5127936 (October 28, 2026) or later
Windows 11 26H2	Resolved	Install KB5127936 (October 28, 2026) or later
Windows 11 24H2	Mitigated, fix still pending	Use the workaround in Fix 2
Windows 11 26H1	Listed as affected	Check its release health page for the current status
Windows Server	Not affected	Look for a different cause

Sources: Microsoft’s 25H2 release health page and 24H2 release health page. The KB5127936 notes say 24H2 no longer gets optional preview updates, so a 24H2 fix will most likely come in a monthly security update. Microsoft hasn’t said when.

Fix 1: Install the October 28 update

1. On the remote PC, open Settings > Windows Update and select Check for updates.
2. Install KB5127936 if it’s offered as an optional update, or any newer cumulative update, then restart.
3. Try the Remote Desktop connection again with the non-admin account.

On managed PCs, IT may need to approve the update first. If the update won’t appear, see how to force Windows Update to check for updates. Once it’s installed, Microsoft says the workaround below isn’t needed.

Fix 2: Temporarily turn off Administrator protection on the host

For 24H2, or until the update can be installed, Microsoft’s workaround is for IT to use their usual policy tool to turn off Administrator protection on the affected hosts. It names the User Account Control Type Of Admin Approval Mode policy and says to reset it:

• Intune: in the settings catalog under Local Policies Security Options, reset User Account Control Type Of Admin Approval Mode in the profile that turned it on.
• Group Policy or a single PC: under Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options, set User Account Control: Configure type of Admin Approval Mode back to the legacy option instead of Admin Approval Mode with Administrator protection.
• Restart the host. Microsoft’s Administrator protection documentation says a restart is needed for the change to take effect.

Then test Remote Desktop with a non-admin account. Keep in mind that this removes an extra layer of protection for admin sign-ins on that PC, so limit it to the Remote Desktop hosts that need it. For what the feature does and how to switch it on or off, see our guide to Administrator protection in Windows 11.

Microsoft doesn’t suggest uninstalling the update, editing the registry or using a Known Issue Rollback for this problem, so stick with the policy change.

Undo the workaround later

Once the host has an update that fixes the issue (KB5127936 or later on 25H2 and 26H2, or the future fix on 24H2), set the policy back to Admin Approval Mode with Administrator protection, restart, and test again. Check the 24H2 release health page each month to see when it changes from Mitigated to Resolved.

If it’s a different Remote Desktop error

• An admin account fails too, or the error mentions CredSSP: see The function requested is not supported.
• The message says you need the right to sign in through Remote Desktop Services: see the Remote Desktop sign-in right fix.

Related guides

• Administrator protection in Windows 11: what it is and how to turn it on
• Remote Desktop “The function requested is not supported”: how to fix it
• “To sign in remotely, you need the right to sign in through Remote Desktop Services”: fix
• How to force Windows Update to check and install updates

Official sources

• Windows 11, version 25H2 known issues and notifications (Windows release health)
• Windows 11, version 24H2 known issues and notifications (Windows release health)
• Administrator protection (Microsoft Learn)