Citrix Remote PC Access registration failures after Windows October 2026 CU – Administrator Protection identified as trigger Hi everyone, I wanted to share an issue we've been troubleshooting with Citrix Remote PC Access and ask whether anyone else has encountered it. We're running Windows 11 25H2 with Citrix VDA 2603/2607, managed through Intune and Open Intune Baseline (OIB). Since the September Windows updates, several workstations have become unregistered. Following the October CU (KB5127648), the issue is consistently reproducible. The VDAs report

AgentNotContactable

, with the DDC logging Event ID 1039:

SecurityNegotiationException: The caller was not authenticated by the service.

We've ruled out basic connectivity, AD secure channel issues, missing network logon rights, and Kerberos ticket acquisition failures. Upgrading to VDA 2607 doesn't help either. After extensive troubleshooting, we've identified Windows Administrator Protection as the trigger. Our reproducible findings: • October CU + Administrator Protection enabled (

TypeOfAdminApprovalMode = 2

) → Registration fails • Same configuration + DDC computer accounts added to local Administrators → Works • October CU + Administrator Protection disabled (

TypeOfAdminApprovalMode = 1

) → Works • October CU uninstalled, without DDC local admin rights → Works Interestingly, our Administrator Protection policy has been assigned through OIB for months, but the problem only appeared with the recent Windows updates. Citrix KB CTX340030 documents the same error and suggests granting the DDCs local administrator privileges. That works, but isn't a security compromise we're willing to make permanently. Microsoft also acknowledges a potentially related Administrator Protection regression affecting RDP in KB5127648, although Citrix VDA registration isn't specifically mentioned. Our current workaround: Disable Administrator Protection via Intune while keeping the October CU installed. We're raising a Citrix support case. Has anyone else experienced this, received feedback from Citrix/Microsoft, or found a better workaround that allows Administrator Protection to remain enabled? I'd really appreciate any feedback or experiences from other Citrix admins. References: • Citrix CTX340030: support.citrix.com/external/article?articleUrl=CTX340030-vda-failin…&language=en_US • Microsoft KB5127648: support.microsoft.com/en-us/…/kb5127648-windows-11-24h2-25h2-26h2-security-update

One of my fellow engineers ran into RDP issues from these patches. MS force enabled tighter Admin Protection. bleepingcomputer.com/news/security/microsoft-recent-windows-updates-may-trigger-remote-desktop-failures

(I'm not sure I understand the question correctly, but I try to answer as I understand it.) We make 99% use of the Open Intune Baseline. We have the baseline: Win - OIB - SC - Device Security - D - Administrator Protection - v3.7 Active in our tenant since around October 2025. The issue only started today with CU 10/2026