Microsoft Windows 11 da administrator bo'lmagan foydalanuvchilarning Administrator himoyasi yoqilgan qurilmalarga ulanishini to'sib qo'ygan muammoni hal qildi.
Bu tuzatish 2026-yil 28-oktabrda chiqarilgan KB5127936 yangilanishiga kiritilgan va keyingi yangilanishlarning bir qismidir. Bu muammo ta'sirlangan tashkilotlar uchun shoshilinch bo'lsa-da, Microsoft bu chiqarilishni shoshilinch tashqi yangilanish emas, balki oldindan ko'rish (preview) yangilanishi sifatida tasniflagan.
Muammo asosan korporativ boshqariladigan Windows qurilmalariga ta'sir qiladi, ular Masofaviy Ish Stoli (Remote Desktop) xostlari sifatida ishlaydi. Ushbu qurilmalarga ulanishga urinayotgan foydalanuvchilar 0xC000000D xatoligiga duch kelishi mumkin, shuningdek, "Funksiyaga uzatilgan token yaroqsiz" xabari bilan. Microsoft bu muammo Administrator himoyasi qanday faollashtirilganidan qat'i nazar yuz berishi mumkinligini ta'kidlagan.
Regressiya 2026-yil 22-sentabrda chiqarilgan KB5124010 yangilanishidan kelib chiqqan — bu xavfsizlik bilan bog'liq bo'lmagan oldindan ko'rish yangilanishi bo'lib, Windows 11 25H2 da OS build 26200.9550 bilan bog'liq. Ushbu yangilanishni yoki keyingi ta'sirlangan versiyalarni o'rnatish, maqsad qurilmasida Administrator himoyasi yoqilgan bo'lsa, administrator bo'lmagan hisoblar uchun masofaviy kirishni to'xtatishi mumkin.
Microsoft 13-oktabrda tekshiruvni boshlagan va 28-oktabrda soat 10:00 PT da muammoni hal qilingan deb e'lon qilgan. Ta'sirlangan mijoz platformalari Windows 11 ning 24H2, 25H2, 26H1 va 26H2 versiyalarini o'z ichiga oladi. Windows Server ta'sirlangan sifatida ro'yxatga olinmagan.
Ulanish nosozligi administrator bo'lmagan Masofaviy Ish Stoli kirishi va Administrator himoyasi o'rtasidagi maxsus o'zaro ta'sirga tegishli. Microsoftning e'lon qilingan tavsifida tokenni qayta ishlashdagi nuqson, ekspluatatsiya usuli yoki ushbu regressiya bilan bog'liq CVE aniqlanmagan. Shuning uchun administratorlar bu ishonchlilik muammosini alohida e'lon qilingan Masofaviy Ish Stoli xavfsizlik zaifliklaridan ajratishlari kerak.
Microsoftning Windows xavfsizlik bazaviy sozlamalaridan foydalanadigan tashkilotlar o'z konfiguratsiyalarini ko'rib chiqishlari kerak. Administrator himoyasi Windows 11 24H2, 25H2 va 26H2 bazaviy sozlamalarida, Xavfsizlik Muvofiqlik To'plami (Security Compliance Toolkit) orqali tarqatiladigan, administratorlar siyosatni o'zgartirmagan bo'lsa, sukut bo'yicha yoqilgan. Natijada, ta'sirlangan xostlar bu sozlamani markazlashtirilgan tarqatish orqali meros qilib olgan bo'lishi mumkin.
Bu xususiyat avval Windows 11 Administrator himoyasi yaxshilanishlari orqali joriy etilgan bo'lib, ma'muriy ko'tarilish atrofidagi nazoratni kuchaytiradi. Uning ishtiroki himoyani keraksiz o'chirmasdan ulanishni tiklashni muhim operatsion masalaga aylantiradi.
Microsoftning chiqarilish salomatligi maslahatiga ko'ra, KB5127936 yoki undan keyingi yangilanish ishlaydigan qurilmalar vaqtinchalik yechimga muhtoj emas. Microsoft eng so'nggi xavfsizlik yangilanishini o'rnatishni tavsiya qiladi, chunki u muhim yaxshilanishlar va muammolarni hal qilishni o'z ichiga oladi.
Yangilanishlarni kutayotgan ta'sirlangan tizimlar uchun IT administratorlari mavjud siyosat-boshqaruv vositalari yordamida Administrator himoyasini vaqtinchalik o'chirishlari mumkin. Microsoft tashkilotlarga "Foydalanuvchi Hisobi Nazorati Ma'muriy Tasdiqlash Rejimi Turi" siyosatini Microsoft Intune yoki Group Policy orqali qayta o'rnatishni yo'naltiradi.
Bu tuzatish avvalgi Masofaviy Ish Stoli ulanish fayllari xavfsizlik yaxshilanishlaridan alohida. Hal qilingan yangilanishni qo'llash vaqtinchalik siyosat yechimiga davomiy bog'liqlikdan qochadi va hujjatlashtirilgan administrator bo'lmagan ulanish nosozligini bartaraf etadi.
SOC-ga tezkor hodisalarni to'xtatish uchun ogohlantirish kontekstini bering.16K SOC dan Tahdid Razvedkasini integratsiya qiling.
Microsoft has resolved an issue in Windows 11 that prevented non-administrator users from connecting to devices with Administrator protection enabled.
This fix was included in KB5127936, released on October 28, 2026, and is part of subsequent updates. While this issue is urgent for affected organizations, Microsoft has categorized the release as a preview update rather than an emergency out-of-band patch.
The problem primarily impacts enterprise-managed Windows devices that serve asRemote Desktop hosts. Users attempting to connect to these devices may encounter error 0xC000000D, along with the message: “The token that was passed to the function is invalid.” Microsoft has indicated that this issue can occur regardless of how Administrator protection was activated.
The regression originated with KB5124010, the September 22, 2026 non-security preview update, associated with OS build 26200.9550 on Windows 11 25H2. Installing that update, or later affected releases, could interrupt remote access for non-admin accounts when the destination device had Administrator protection switched on.
Microsoft opened its investigation on October 13 and marked the issue resolved on October 28 at 10:00 PT. Affected client platforms include Windows 11 versions 24H2, 25H2, 26H1, and 26H2. Windows Server is not listed as affected.
The connection failure concerns a specific interaction between non-admin Remote Desktop access and Administrator protection. Microsoft’s published description does not identify an underlying token-processing defect, an exploitation technique, or a CVE associated with this regression. Administrators should therefore distinguish this reliability issue from separately disclosed Remote Desktop security vulnerabilities.
Organizations using Microsoft’s Windows security baselines should review their configurations. Administrator protection is enabled by default in the Windows 11 24H2, 25H2, and 26H2 baselines distributed through the Security Compliance Toolkit, unless administrators have changed the policy. As a result, affected hosts may have inherited the setting through centralized deployment.
The feature, previously introduced through Windows 11 Administrator protection enhancements, strengthens controls around administrative elevation. Its involvement makes restoring connectivity without unnecessarily disabling protection an important operational consideration.
According to Microsoft’s release health advisory, devices running KB5127936 or a later update do not require the workaround. Microsoft recommends installing the latest security update because it incorporates important improvements and issue resolutions.
For affected systems awaiting updates, IT administrators can temporarily turn off Administrator protection using existing policy-management tools. Microsoft directs organizations to reset the “User Account Control Type Of Admin Approval Mode” policy through Microsoft Intune or Group Policy.
This remediation is separate from earlier Remote Desktop connection-file security improvements. Applying the resolved update avoids continued reliance on the temporary policy workaround while addressing the documented non-admin connection failure.
Give your SOC the alert context to stops incidents quickly.Integrate Threat Intel from 16K SOCs.