After quite some troubleshooting, we finally identified Windows Administrator Protection as the trigger. While we have a reliable workaround, the underlying compatibility issue remains unresolved.
The environment
Our Remote PC Access environment consists of:
- Windows 11 25H2 and 26H2 workstations
- Citrix Virtual Delivery Agent (VDA) 2603 and 2607
- Two Citrix Delivery Controllers
- Microsoft Intune with Open Intune Baseline (OIB)
- Windows October 2026 cumulative update (KB5127648)
The problem
The first registration failures appeared following the September 2026 Windows updates. Reinstalling the affected workstations initially resolved the issue.
However, after deploying the October CU, the problem returned and became consistently reproducible.
The Citrix Desktop Service reports:
The registration was refused due to AgentNotContactable.
On the Delivery Controller, Event ID 1039 provides a more interesting error:
The Citrix Broker Service failed to contact virtual machine.
Error details:
Exception 'The caller was not authenticated by the service.'
of type 'System.ServiceModel.Security.SecurityNegotiationException'.Interestingly, upgrading the VDA from 2603 to 2607 did not resolve the issue. Even more frustrating, uninstalling the Windows cumulative update immediately restored VDA registration.
This strongly suggested a Windows-related regression rather than a Citrix VDA installation problem.
Troubleshooting
We started by verifying communication and authentication between the Delivery Controllers and affected VDAs.
Our findings:
- Citrix BrokerAgent service was running.
- TCP 80 connectivity from the DDC to the VDA was successful.
- Active Directory secure channel was healthy.
- Both Delivery Controller computer accounts had the required Access this computer from the network permission.
- Kerberos ticket acquisition for the VDA’s
HOST/FQDNSPN succeeded using AES-256. - Updating the VDA to 2607 did not help.
Eventually, we found Citrix KB CTX340030, which describes the same AgentNotContactable registration failure caused by a SecurityNegotiationException.
One of the suggested workarounds is adding the Delivery Controller computer accounts to the local Administrators group on the VDA.
To our surprise, this immediately restored registration!
Of course, granting Delivery Controllers local administrative privileges on every workstation is not something we would consider an acceptable permanent solution.
But it gave us an important clue.
The actual trigger: Windows Administrator Protection
We eventually identified a connection with Windows Administrator Protection.
This feature changes how Windows handles administrative privileges, using just-in-time elevation and isolated administrator tokens.
It is controlled by the following registry value:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
TypeOfAdminApprovalModeThe relevant values are:
1– Legacy Admin Approval Mode2– Admin Approval Mode with Administrator Protection
We performed several tests on the same workstation, changing only one variable at a time.
| Configuration | VDA registration |
|---|---|
October CU installed, Administrator Protection enabled (2), DDCs not local admins |
FAIL |
October CU installed, Administrator Protection enabled (2), DDCs local admins |
WORKS |
October CU installed, Administrator Protection disabled (1), DDCs not local admins |
WORKS |
| October CU uninstalled, DDCs not local admins | WORKS |
All combinations were successfully reproduced.
Disabling Administrator Protection immediately resolved the registration issue after the required reboot, without granting the DDCs any additional privileges.
Why did this suddenly happen in October?
This was probably the most interesting part of our investigation.
We had deployed the Open Intune Baseline several months earlier, including the Administrator Protection configuration, and assigned it to all devices.
The configuration itself had not changed.
Looking at the OIB v3.7 release notes from October 15, 2025, we found that Administrator Protection had already been introduced through the following policy:
Win - OIB - SC - Device Security - D - Administrator Protection - v3.7
At the time, the feature was still limited to Windows Insider builds. The OIB maintainer had deliberately included the configuration in preparation for its eventual public release.
According to Microsoft’s Windows Message Center, Administrator Protection entered a controlled rollout in August 2026, became generally available with the September non-security preview update, and was enabled by default through Windows security baselines with the October 2026 security update.
In other words, our Intune configuration had been waiting for Windows to catch up.
The exact reason why individual machines started failing during September remains unclear, but the rollout timeline provides a plausible explanation.
Microsoft has also documented a potentially related known issue in KB5127648: Remote Desktop connections for non-administrator users may fail with error 0xC000000D when Administrator Protection is enabled.
Microsoft recommends temporarily disabling Administrator Protection while working on a fix.
However, Microsoft’s documented RDP issue does not explicitly cover Citrix VDA registration, so we cannot yet confirm whether both problems share the same underlying cause.
Our temporary workaround
For now, we have decided to disable Administrator Protection on affected Remote PC Access workstations while keeping the October security update installed.
In Microsoft Intune, the relevant setting is:
Settings Catalog → Local Policies Security Options → User Account Control Type Of Admin Approval Mode
Set it to:Legacy Admin Approval Mode
If you are using Open Intune Baseline v3.7 or later, review the Administrator Protection profile mentioned above and adjust its assignment or configuration accordingly. A restart is required.
This restores Citrix Remote PC Access without adding the Delivery Controllers to the local Administrators group.
Normal Windows User Account Control (UAC) remains enabled, although the additional security benefits of Administrator Protection are temporarily unavailable.
Conclusion – not the end of the story
We now have a fully reproducible scenario demonstrating that Windows Administrator Protection interferes with Citrix Remote PC Access VDA registration on our Windows 11 25H2 devices.
What remains unclear is why the Citrix Delivery Controller’s authentication succeeds when its computer account has local administrator privileges, but fails otherwise.
Is Citrix relying on behavior that changed with Administrator Protection? Is this another manifestation of the Windows regression Microsoft has already acknowledged? Or will both vendors need to make changes?
We have enough evidence to raise the issue with Citrix Support, including a reproducible test scenario and a temporary workaround that does not require rolling back security updates.
For now, our Remote PC Access environment is operational again. However, disabling a Windows security feature should not be the long-term solution.
I’ll update this article as soon as we learn more from Citrix or Microsoft.
References
- Citrix CTX340030 – VDA registration fails with AgentNotContactable
- Microsoft KB5127648 – October 2026 Windows 11 cumulative update
- Microsoft Learn – Administrator Protection
- Microsoft Windows Message Center – Administrator Protection rollout
- Open Intune Baseline – GitHub repository
- Open Intune Baseline v3.7 – Release Notes
