Microsoft has fixed a known issue that prevented non-admin users from connecting to devices via Remote Desktop when the “Administrator protection” security feature is enabled.
Administrator protection prompts standard users to authenticate with Windows Hello (PIN or biometric) when attempting to change the Windows Registry or install new applications. The feature began rolling out in October 2025 and is now enabled by default in organizations using Windows security baselines following installation of the October 2026 Windows security update.
What went wrong
On October 13, Microsoft acknowledged that Remote Desktop connections could fail with error 0xC000000D after installing the KB5124010 September 2026 non-security preview update, or any Windows updates released since then, on systems running Windows 11 24H2 and later.
Microsoft said the issue “primarily affects enterprise-managed remote devices used as Remote Desktop hosts with Administrator protection enabled, regardless of how the feature was enabled.”
The fix
Microsoft confirmed on Wednesday that the issue is resolved for users who install this month’s KB5127936 preview update, released October 28, 2026.
The company recommends installing the latest security update, noting it contains additional improvements and fixes beyond this specific issue.
For organizations that prefer to wait for next month’s Patch Tuesday cumulative update rather than install the preview release, Microsoft offers a temporary workaround: IT administrators can disable Administrator protection by resetting the “User Account Control Type Of Admin Approval Mode” policy via Microsoft Intune or Group Policy.
A recurring pattern
This is not the first time Windows updates have disrupted Remote Desktop connectivity. Microsoft fixed a similar issue in March 2025 affecting Remote Desktop and RDS connections after updates released since January 2025. It also issued emergency out-of-band updates last month to address Remote Desktop Services failures caused by the September 2026 security updates.
Enterprises relying on Remote Desktop hosts with Administrator protection enabled should prioritize testing and deploying KB5127936 or later updates to avoid continued connectivity disruptions.
