TL;DR: Microsoft has confirmed that after the September 2026 preview update KB5124010 "or later updates", non-admin users may be unable to connect via Remote Desktop to devices with Administrator protection enabled. The issue is listed as Mitigated, not fixed, as of the October 13, 2026 release-health update. (Microsoft release health)
Symptoms
- Connections fail with error
0xC000000Dand the message "The token that was passed to the function is invalid." (Microsoft)
Who is affected
- Non-admin users connecting to remote devices that have Administrator protection enabled, regardless of how the feature was turned on. It primarily affects enterprise-managed devices used as Remote Desktop hosts. (Microsoft)
- Microsoft notes that Administrator protection is on by default in the Windows 11 24H2, 25H2 and 26H2 security baselines (Microsoft Security Compliance Toolkit), unless your organization has configured the policy differently. (Microsoft)
- Platforms: Windows 11 26H2, 26H1, 25H2 and 24H2. No server versions are listed. (Microsoft)
Vendor status & workaround
- Status: Mitigated. Microsoft says it is "working to address this issue in a future Windows update." (Microsoft)
- Workaround: admins can temporarily turn off Administrator protection by resetting the "User Account Control Type Of Admin Approval Mode" policy in Intune or Group Policy. (Microsoft)
Severity, fix status & rollback (added 2026-10-15)
- Severity: Microsoft doesn't assign a severity rating to known issues. MoonSec rating: High operational impact for RDP-host fleets that use Administrator protection (for example, security-baseline users); no security impact.
- Fix status: Mitigated, not fixed. Microsoft says it's "working to address this issue in a future Windows update." (Release health) The issue is also listed under "Known issues in this update" in the October 13 KB5127648 article, with the Known Issue entry added on October 14, 2026. (KB5127648)
- Rollback guidance: Microsoft documents no Known Issue Rollback (KIR) for this issue. The only documented mitigation is to temporarily turn off Administrator protection on affected hosts by resetting the "User Account Control Type Of Admin Approval Mode" policy in Intune or Group Policy. (KB5127648) Microsoft doesn't recommend uninstalling the update for this issue in either source. MoonSec analysis: uninstalling October wouldn't help anyway, because the issue started with the September preview KB5124010 and uninstalling would drop the exploited CVE-2026-96951 fix.
- Related change in the same update (heads-up): KB5127648 switches NTLMv1-derived SSO credential generation from Audit to Enforce mode when
BlockNtlmv1SSOisn't set and Credential Guard is off, which "might affect Wi-Fi, Ethernet, and VPN connections that use MS-CHAPv2-based authentication" (release note added Oct 15). (KB5127648)
Should you hold the patch?
MoonSec analysis: Holding back October won't help, because the issue started with the September preview and carries into later updates. Weigh it against relaxing Administrator protection on RDP hosts, which reduces a security control. Test RDP hosts that use security baselines first.
Related October changes (same page)
- The October 13, 2026 update KB5127648 resolved the black-screen/desktop loading issue on some virtual desktop environments (primarily AVD with FSLogix). It also resolved the AC-3 audio application crashes. (Microsoft)
Timeline
- 2026-09-22: KB5124010 preview released (originating update) (Microsoft)
- 2026-10-13, 09:43 PT: Known issue opened on release health (Microsoft)
- 2026-10-13, 10:13 PT: Last updated, status Mitigated (Microsoft)
Sources
- Press: BleepingComputer, Oct 15, 2026 (mentions Microsoft confirming this issue)
- Primary: KB5127648
- Primary: Windows 11, version 24H2 known issues (Microsoft Learn)
Last verified 2026-10-15Report an error: contact@moonsec.ai