- Published
- Source
- BleepingComputer
- Filed under
- Microsoft
Microsoft has confirmed that non-admin users may be unable to connect to devices via Remote Desktop after installing recent Windows updates if the "Administrator protection" security feature is enabled.
Practical steps for any organisation
- Patch quickly, starting with anything facing the internet.
- Use multi-factor authentication everywhere it is offered.
- Keep tested, offline backups – and a plan for the day you need them.
More helpNCSC: 10 Steps to Cyber Security (opens in a new tab)NCSC: incident management (opens in a new tab)
Defender’s notebook
The attacker technique behind this story, in MITRE’s terms – and what to check in your own estate.
External Remote Services
Persistence, Initial AccessWhat a defender checks
- List every VPN, remote desktop and remote-access gateway you expose.
- Require MFA on all of them, and keep them patched.
- Alert on sign-ins from new countries, networks or devices.
Build the skillBlue Team Engineer · Network Security Engineering
© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation.
MyCyberWay training
Microsoft SC-200 exam training
Defender and Sentinel in the headlines? That's the SC-200 toolkit.
Tutor-led SC-200 preparation: running security operations in Microsoft Sentinel and Defender XDR, responding to incidents across identity, endpoint, email and cloud, and threat hunting with KQL.
- Microsoft Sentinel and Defender XDR
- Incident response across Microsoft 365
- Threat hunting with KQL
Headlines and short summaries only, except where a public body publishes under an open licence. Every story links to its publisher, who owns it. MyCyberWay does not edit or endorse third-party reporting.
