I was querying a domain and found an interesting ACL that I haven't seen before.
One of the DomainComputer accounts has a CanRDP right set to another domain computer. How would this work? The domain computer account object using the generated clear-text password could use mstsc.exe to RDP in? Or is there more AD trickery behind the scenes? What would the practical reason be?
Thanks in advance!