Microsoft Patches Remote Desktop Failures Caused by Administrator Protection Feature in Windows 11 24H2
What Happened — Microsoft confirmed that a Windows update (KB 5124010, released September 2026) broke Remote Desktop connections for non‑admin users on devices where the “Administrator protection” security feature is enabled. The issue manifested as error 0xC000000D on Windows 11 24H2 and later, affecting enterprise‑managed hosts that rely on Remote Desktop for remote administration. Microsoft released a preview update (KB 5127936) on 28 Oct 2026 that resolves the problem, and a cumulative Patch Tuesday update will include the fix. A temporary workaround is to disable Administrator protection via Intune or Group Policy until the patch is applied.
Why It Matters for Trust & Control Assurance — The incident highlights the need for continuous control mapping and evidence of patch‑management and configuration‑change processes to demonstrate that security baselines remain effective after updates.
Who Is Affected — Enterprises across all sectors that enable the Administrator protection baseline on Windows 11 devices and rely on Remote Desktop for remote management.
Recommended Actions
- Deploy the KB 5127936 update (or the next cumulative Patch Tuesday) to all affected endpoints.
- If immediate remediation is required, use Intune or Group Policy to temporarily disable the “User Account Control → Admin Approval Mode” setting.
- Verify that Remote Desktop connectivity is restored and document the change in your configuration‑management system.
- Review your patch‑testing workflow to ensure future baseline changes are validated before wide‑scale rollout.
Technical Notes
- Attack vector: Misconfiguration triggered by a Windows security update.
- Affected OS: Windows 11 24H2 and later with Administrator protection enabled.
- Fix: KB 5127936 (preview) and upcoming cumulative updates.
- Workaround: Reset “User Account Control → Admin Approval Mode” via Intune or Group Policy.