Microsoft ties Remote Desktop error 0xC000000D to Windows 11 Administrator protection

A non-administrator opens Remote Desktop, signs in to a work PC and gets error 0xC000000D with the message "The token that was passed to the function is invalid." ^[1][5] According to TechRepublic's account of Microsoft's update documentation, the trigger is a configuration: an enterprise-managed host with Administrator protection switched on ^[1]. Microsoft has identified that configuration but has not explained the token-validation failure underneath it, and it has not said when a permanent fix will arrive ^[6][7].

Microsoft documented the problem 22 days after the preview update it names ^[18]. The only mitigation in TechRepublic's report is to turn the feature off on the host ^[10].

The people locked out are non-administrators. TechRepublic's opening describes them as employees trying to reach remote work PCs ^[19], so we'd expect the first call to reach the helpdesk, not the team that owns the security baseline.

The version list needs a careful read. Microsoft lists 24H2, 25H2, 26H1 and 26H2 as affected ^[4], but the baselines that enable Administrator protection cover 24H2, 25H2 and 26H2 ^[9]. The source lists no baseline for 26H1, so we'd expect a 26H1 host to be affected only where someone enabled the feature directly. Version numbers also mislead. The 26H2 rollout uses an enablement package for eligible 24H2 and 25H2 PCs, and 26H1 follows a separate servicing path, so TechRepublic advises checking each device's version and installed updates before troubleshooting ^[15].

Keep this ticket apart from the September Remote Desktop Services regression. Microsoft resolved that one with emergency updates released September 14 ^[14].

The change itself is small. In Group Policy the setting sits under Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options ^[12]. Moving it to legacy mode does not require disabling User Account Control entirely ^[13]. What comes off is the Windows Hello check that Administrator protection puts on software installs and system changes ^[8].

We'd limit the exemption to named hosts. Two questions per host settle it: do non-administrators connect to it over Remote Desktop, and does its policy currently read value 2 ^[11]? If both answers are yes, set value 1 and restart ^[11]. Any other combination keeps the baseline as it is, which matches TechRepublic's advice that unaffected systems retain their existing protections ^[16]. The tradeoff is a list of exempt hosts that someone has to own. TechRepublic says to document the modified devices and restore Administrator protection once a fix is verified ^[17].