Microsoft lists a known issue, status Mitigated as of Oct 13: non-admin users connecting via Remote Desktop to hosts with Administrator protection enabled may get error 0xC000000D ("The token that was passed to the function is invalid") after the September non-security preview or later updates on Windows 11 24H2/25H2/26H1/26H2. Administrator protection is on by default in the 24H2, 25H2 and 26H2 security baselines, so baseline-managed fleets are most exposed. Don't uninstall the October cumulative update, which carries the exploited CVE-2026-96951 fix. Use Microsoft's interim workaround: turn off Administrator protection on affected RDP hosts by resetting the "User Account Control Type Of Admin Approval Mode" policy via Intune or Group Policy. Scope it only to RDP hosts and revert once Microsoft ships a fix.