Microsoft has released KB5127936, an October 28 preview update that finally fixes a Remote Desktop bug that had been locking non-administrator users out of their own PCs since September. If you or your staff use Remote Desktop to connect into a Windows 11 machine — at the office, at home, or at a shop — and you've been seeing error 0xC000000D or a message about an invalid token, this update is the fix.
What the bug did
Microsoft resolved a known issue that prevented non-admin users from connecting to devices via Remote Desktop when the "Administrator protection" security feature is enabled. When Administrator protection is on, Windows prompts standard users to authenticate with Windows Hello (PIN or biometric) before changing the Registry or installing apps. The feature began rolling out in October 2025 and is now enabled by default in organizations using Windows security baselines after installing the October 2026 Windows security update.
The failed connections displayed "The token that was passed to the function is invalid." The same update also fixes an issue that prevented the policy for trusted Remote Desktop publisher certificate thumbprints from being configured through Microsoft Intune.
Microsoft has been struggling with Remote Desktop problems in Windows 11 for a while. After the optional update of September 2026, users without administrator rights could not establish a Remote Desktop connection to a device with administrator protection enabled. Disabling the feature was the only workaround. The company already released an emergency patch, but it did not deliver the desired result. Now Microsoft has come up with a permanent fix.
Who is affected
Affected client platforms include Windows 11 versions 24H2, 25H2, 26H1, and 26H2. The problem primarily impacts enterprise-managed Windows devices that serve as Remote Desktop hosts , but any Windows 11 PC configured with Administrator protection could hit the error — including home users who remote into a family member's machine to troubleshoot it. If you have been chasing phantom login errors on an otherwise healthy Windows desktop, this update is worth installing before assuming the hardware is at fault.
Fixes in the same update also cover Smart App Control, Always On VPN, WSL2 on AMD, Windows Sandbox, and AMD HDMI and DisplayPort audio , so users who have been troubleshooting VPN drops or missing audio over HDMI on a Windows 11 laptop should see improvement after installing it.
How to install the fix
The fix arrived in the October 28, 2026, non-security preview update, KB5127936, which updates Windows 11 versions 25H2 and 26H2 to builds 26200.9818 and 26300.9818, respectively. To get it, open Settings, go to Windows Update, and under Optional updates available, find the 2026-10 Preview Update (KB5127936) and select it to download and install.
KB5127936 is a preview update; Microsoft says later updates also include the fix and recommends installing the latest security update. If you are waiting to deploy an update, avoid disabling Administrator Protection unless needed as a temporary workaround, since doing so removes a security safeguard. In other words: don't turn off the security feature just to make Remote Desktop work — install the patch instead. If a cumulative update refuses to install or your PC fails to boot cleanly after it, that's the point to stop guessing and bring the machine into a local repair shop rather than risk a bad rollback.
Not to be confused with a Remote Desktop security flaw
Administrators should distinguish this reliability issue from separately disclosed Remote Desktop security vulnerabilities. The Administrator protection feature strengthens controls around administrative elevation. This remediation is separate from earlier Remote Desktop connection-file security improvements. If you've seen suspicious Remote Desktop activity on your PC — unexpected sign-ins, cursor movement when you're away, or files opening on their own — that is a separate problem and warrants a malware and intrusion check, not a preview update.
What This Means for York, PA
If you run a York-area small business that relies on Remote Desktop to reach office PCs — common for accountants, law offices, and medical practices around York County — install KB5127936 on your Windows 11 hosts before Monday to avoid staff lockouts. If an update won't apply or a machine won't boot afterward, York Computer Repair at 2069 Carlisle Rd is open walk-in Mon–Fri 9–5 at 717-739-9675.
Sources
- Microsoft fixes Remote Desktop failures caused by recent Windows updates — BleepingComputer
- Windows 11 KB5127936 fixes Remote Desktop error 0xC000000D — 4sysops
- Resolved issues in Windows 11, version 26H2 — Microsoft Learn
- KB5127936 Windows 11 Preview Update: What's New and Fixed — Admin365
- Microsoft Fixes Windows 11 Bug Blocking Remote Desktop Connections for Non-Admin Users — Cyberpress