If Remote Desktop fails with error 0xC000000D and the message "The token that was passed to the function is invalid" right after a Windows 11 update, you are most likely hitting a known update regression, not a broken network or a wrong password. Per Microsoft's Windows 11 release health page, it was introduced by the optional preview update KB5124010 and is addressed by KB5127936 and later cumulative updates. Install the fix on the PC you connect to (the host), or use the temporary workaround described below.
Last verified: 3 November 2026 against the Windows 11 release health page (status last updated 28 October 2026). Microsoft updates these notices, so confirm the current status there before you change security settings.
Key takeaways
- The error appears on the Windows 11 PC being connected to (the RDP host), not on the laptop you connect from.
- Microsoft's pattern: standard (non-administrator) users fail to connect, while administrator accounts may still work, when Administrator protection is active on the host.
- Microsoft's release-health entry ties it to KB5124010 (22 September 2026 preview) and later updates, with the fix delivered in KB5127936 (28 October 2026) and later updates. Microsoft lists Windows 11 24H2, 25H2, 26H1 and 26H2 as affected.
- Do not reset the PC or reinstall Windows over this. Install the fix update first.
- This is not the same as 0xc000000e, which is a boot problem. Different code, different cause.
What the error actually tells you
Windows reports 0xC000000D as an invalid parameter status. In the Remote Desktop case, the message is "The token that was passed to the function is invalid." A token is the security badge Windows creates when you sign in. During an RDP sign-in the host builds that badge for the remote user. When the badge is built wrongly or rejected, the session never starts and you see this message on the client.
That is why the usual RDP checklist (firewall, port 3389, network, password) often changes nothing here. Your connection reaches the host. The failure happens a moment later, during sign-in.
Who is affected and why it started suddenly
Microsoft's release health notice describes the issue like this: Windows 11 versions 24H2, 25H2, 26H1 and 26H2, a host with Administrator protection enabled, and connecting users who are not administrators. The trigger is the optional preview update KB5124010 released on 22 September 2026, or any later update that contains it. Because later monthly updates roll those changes forward, many people saw the problem appear after a normal Patch Tuesday in October.
Administrator protection is a Windows 11 security feature, and it can be switched on through security baselines without anyone noticing. So a small office that never touched the setting can still be affected if an IT provider or a baseline applied it. Microsoft says this mainly affects enterprise-managed PCs used as Remote Desktop hosts, and its Windows security baselines turn Administrator protection on by default. Home users with a single administrator account who connect to their own PC are less likely to see it.
| Situation | How to recognise it | Where to go |
|---|---|---|
| Standard user cannot RDP into a Windows 11 host after an update | Client shows 0xC000000D, "The token that was passed to the function is invalid" | Fix 1 or the temporary workaround |
| Administrator account connects, standard user does not | Same host, two accounts, different results | Strong sign of this regression |
| Nobody can connect, error is a different code | 0x204, 0x904 or a credentials message instead | A different problem: network, NLA or credentials |
| PC shows 0xc000000e on startup | Blue recovery screen before Windows loads | See the boot error page linked below |
The 0xC000000D code is generic and also appears in other contexts, such as app crashes or boot problems, so match the full message and the "after an update" timing before you apply the fix below.
Fixes in order of likelihood
Fix 1: Install the update that contains the fix (on the host)
The most reliable answer is the update itself. Microsoft says the fix is in the updates released 28 October 2026 (KB5127936) and later. The KB number can differ by version, so check your version's update history. Microsoft's wording is "and later", so the November 2026 cumulative update (10 November) should also include it; confirm in your version's update history. Do this on the PC you are connecting to, because that is where the sign-in fails.
- Sit at the host, or reach it through another tool such as a console or a different remote tool.
- Open Settings, then Windows Update, and select Check for updates. Install everything offered, then restart.
- Check which updates are present. In PowerShell:
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 10Get-HotFix -Id KB5127936If the second command returns a row, the fix is installed. If it does not, a later cumulative update may already contain the fix: compare your OS build with the build listed for KB5127936 on the update history page for your version. Then retry the RDP sign-in with the standard user. If your version does not yet get that update, see the next fix.
Fix 2: Confirm your Windows version and build
Fixes are delivered per version. Press Windows + R, type winver, and press Enter. Note the version (for example 25H2) and the OS build. Compare it with the build listed on the Windows 11 release health page and the update history page for your version. Do not guess here: the release notes for your exact version are the authority.
Fix 3: Use the temporary workaround while you wait
Microsoft's workaround for IT administrators is to reset the "User Account Control Type Of Admin Approval Mode" policy in Intune or Group Policy, which temporarily turns Administrator protection off. Microsoft says you do not need this if you install KB5127936 or later. In a managed company environment this is a change for your IT administrator, since it lowers a protection that someone enabled on purpose. On a standalone PC, only change it if you understand the trade-off, and turn it back on once the fix update is installed. Policy and registry names can differ by build, so follow Microsoft's own text and do not paste registry values from forum posts into a production machine.
Fix 4: Connect with an administrator account for now
In community reports, administrator accounts kept working while standard accounts failed. That makes an administrator login a short-term bridge if you only need to reach the PC today. It is not a good long-term answer, because giving everyone admin rights to dodge a bug weakens your setup. Only use an existing administrator account. Do not give a user admin rights as the fix.
Not sure what is wrong? Get a diagnosis first.
Our certified tech can connect remotely, check your software, drivers and backups, and tell you honestly whether the problem needs a hands-on repair.
Tests that separate this bug from look-alikes
Before you change anything, run three quick tests on the host. First, sign in locally at the keyboard as the same standard user. If local sign-in works and only RDP fails, the problem is in the remote path. Second, try RDP with a different standard account. If every standard account fails and the administrator succeeds, that matches the release-health description. Third, check the date. Did the failure start right after an update installed? Open Settings, Windows Update, Update history, and look for the date of the last quality update.
If none of the accounts can connect, or the error text differs, work through the generic RDP basics instead: Remote Desktop enabled in Settings, the user listed under Remote Desktop users, the PC awake, and the network path open. That is a different problem and needs its own diagnosis. Our guide on Windows Update stuck or failing also helps if the fix update refuses to install.
When this is not 0xC000000D from the update
The same hex value is used for other failures. If your PC stops at a blue recovery screen at startup, you are in boot-repair territory and should read our page on error 0xc000000e, which is a different code with a different cause. If an app crashes on launch with a status code, look at the matching app-crash pages instead, such as 0xc0000142. The key distinction is the exact wording: "The token that was passed to the function is invalid" together with a Remote Desktop session is the signature of this issue.
What not to do
- Do not reset Windows or reinstall. This is an update regression on the host, and a clean install would pull the same update again.
- Do not uninstall security updates as a first move. Removing a Patch Tuesday update also removes security fixes. Some readers report it helped, but it is not a recommended long-term fix.
- Do not open RDP to the internet to "test". If port 3389 is exposed directly, put it behind a VPN or a gateway instead. A connection bug is never a reason to widen exposure.
- Do not paste registry edits from forums. Community-reported values may not match your build.
- Do not leave Administrator protection off. Treat any exception as temporary and write down the date you changed it.
When to call a professional
Get help if the host is a business server or a shared PC and you cannot reach it any other way, since a wrong policy change can lock everyone out. Also ask for help if the fix update fails to install repeatedly, if you see other errors such as 0x800f081f or 0x80073712 in Windows Update, or if you are not sure which accounts and policies are set. Our technicians can work on the PC remotely, check the update state, and apply the fix safely. See remote repair and our Windows support page. For component errors that block the fix, see 0x800f081f and 0x80073712.
Prevention: stop update surprises on your RDP host
- Keep one test PC that receives updates a week before the PC others rely on.
- Avoid installing optional preview updates (the "non-security preview" ones) on machines used for remote access. The regression arrived through one of these.
- Keep a second way into a remote host, such as a console, a remote support tool, or someone on site.
- After each monthly update, test an RDP sign-in with a standard account, not only with an administrator.
- Read the Windows 11 release health page after Patch Tuesday. Known issues and workarounds appear there first.
For the wider picture of what changed in this month's builds, see our note on Windows 11 26H2 known issues and fixes.
FAQ
What does error 0xC000000D mean in Remote Desktop?
It is an invalid-parameter style status. In this case the message says "The token that was passed to the function is invalid," meaning the remote sign-in could not create a valid security token on the host, so the session does not start.
Which update caused it?
According to Microsoft's release health page, the optional preview update KB5124010 (22 September 2026) introduced it, and later updates built on it carried the problem. Check the release health page for the current list for your version.
Which update fixes it?
Microsoft lists Windows 11 24H2, 25H2, 26H1 and 26H2 as affected, and says the fix is in the updates released 28 October 2026 (KB5127936) and later. The KB number can differ by version, so check your version's update history. The November 2026 cumulative update (10 November) should also include it.
Why do administrators connect fine but standard users fail?
The reported conditions are a host with Administrator protection active and a connecting user without administrator rights. The bug affects how the token is built for standard users in that setup, as described in Microsoft's notice.
Is it safe to turn off Administrator protection?
Only temporarily and with care. It lowers a security feature. If your IT team manages the PC, ask them to change the policy and reverse it after the fix update is installed.
Is this the same as error 0xc000000e?
No. 0xc000000e is a boot error where Windows cannot find a boot device or boot configuration. 0xC000000D in Remote Desktop is a sign-in token problem after an update.
Should I uninstall the Windows update?
Not as a first step. Install the fix update, or use the temporary workaround. Uninstalling removes security fixes, and it is only a last resort for a short time.
Can your team fix it remotely?
Yes. A technician can check your version, install the right update, and test a standard-user RDP sign-in without you visiting a shop.