- Error 0xC000000D is caused by the Administrator Protection feature in recent versions of Windows 11 after installing specific updates.
- It mainly affects users without administrator privileges who try to connect to computers managed by Intune or GPO.
- The temporary solution is to change the administrator approval mode to Legacy mode and restart the system.
If you've suddenly found that Windows 11 Remote Desktop has stopped working and is throwing the dreaded 0xC000000D error , don't despair. This error, which is usually accompanied by a message indicating that the token passed to the function is invalid , has become a major headache for many, especially after some recent system updates that have shifted some security features.
The strangest thing is that, in most cases, it has nothing to do with you entering the wrong password or your router malfunctioning. It's an internal technical conflict related to permissions management and account protection, which mainly affects corporate environments or professionally managed systems, although it can also appear in home setups if certain settings have been changed.
The culprit: Administrator Protection
The main problem stems from a feature called Administrator Protection . This security tool is designed so that even if you're using an account with elevated privileges, Windows forces you to operate as a standard user. Only when you need to do something "serious," such as installing software or modifying the registry, does the system ask you to verify your identity using Windows Hello to generate a temporary token. It's a great measure for curbing malware, but it has turned out to have a rather annoying side effect with RDP.
This error occurs when three specific factors coincide: the computer you're trying to access is running Windows 11 (versions 24H2, 25H2, or 26H2) , has update KB5124010 or later installed , and administrator protection is enabled. The key detail is that the error only occurs if the person trying to connect doesn't have administrator privileges on the remote computer. If you are the administrator, you'll most likely be able to connect without any problems.
For businesses using Microsoft Intune or Group Policy Objects (GPOs) , the risk is greater, as Microsoft's security baselines typically enable this protection by default. Therefore, many users have found themselves locked out of their PCs without having changed anything at all, simply by applying the recommended security patches .
How to fix error 0xC000000D step by step
While Microsoft releases a definitive patch, the only solution is to use a technical workaround to disable the problematic feature. If you manage your office computers, you have two options depending on your administration tool:
- Via Group Policy Orders (GPO): You need to navigate to Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options. There, look for the option Configure type of Admin Approval Mode and change it to Legacy Admin Approval Mode (Default)If you're doing this on a standalone PC, you can use the command secpol.msc.
- Via Microsoft Intune: In the configuration catalog, you must reset the parameter User Account Control Type Of Admin Approval Mode within the local policy security options.
It's crucial to remember to restart your computer after making the change, otherwise the system will continue to ignore the modification. Keep in mind that by doing this, your computer loses that extra layer of security, so ideally, you should only apply it to hosts that receive connections from regular users and reactivate it when the official update is released.
Other possible causes of Remote Desktop failures
If the error isn't exactly 0xC000000D, or if the previous troubleshooting steps didn't work, you might be facing a more classic connectivity issue. First, make sure the remote computer has Remote Desktop Protocol ( RDP) enabled in Settings > System > Remote Desktop. Sometimes, temporarily disabling Network Level Authentication (NLA) helps diagnose whether the problem is related to credentials.
Another very common scenario in companies is duplicate security identifiers (SIDs) . This happens when machines are created from a cloned image without running the Sysprep process with the /generalize option . If two PCs have the same SID, the Kerberos authentication system malfunctions and blocks the connection. The solution here is to run sysprep.exe in C:\Windows\System32\Sysprep, check the generalize box, and restart, although this will require rejoining the machine to the domain.
It's also worth checking your Windows Firewall or third-party antivirus software. If you suspect port 3389 is blocked, you can use the psping tool to check if the remote computer is responding. If you see a 100% loss, it's very likely that a firewall rule is blocking the traffic.
Advanced technical checks
For those who want to get straight to the point with the registry or console, there are quick checks. In the Registry Editor, check the fDenyTSConnections key in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server. If the value is 1, RDP is disabled; change it to 0 to enable it . Also, verify that the TermService (Remote Desktop Services) and UmRdpService services are running.
In extreme cases, the problem could lie with the RDP self-signed certificate . If the certificate is corrupt, you can delete it from the Certificates Console (MMC) in the Remote Desktop folder and restart the service so that Windows automatically generates a new one . Also, be sure to check that the MachineKeys folder has the correct permissions so that the system can write these certificates.
To resolve this issue, the first step is to identify whether the problem stems from Windows 11's new administrator protection, which requires reverting to legacy approval mode, or if it's related to network issues, certificates, or duplicate SIDs due to image cloning. While error 0xC000000D can be mitigated by adjusting user account control policies, general connection failures are resolved by checking port 3389, enabling the service in the registry, and ensuring the firewall isn't blocking access.