RDP uses a protocol called CredSSP to delegate credentials. The process works like this.
- MSTSC prompts for credentials (or uses saved creds)
- MSTSC requests a network logon ticket (Kerberos or NTLM) to the machine typed into the "computer" field using the credentials from (1)
- A TLS session is established with the remote machine (this is why you sometimes see the yellow dialog indicating the typed name doesn't match the certificate name)
- The ticket from (2) is sent to authenticate the client machine
- A response to the ticket from (2) is sent to client to authenticate the target machine
- An encryption key is negotiated between the client and server
- The client encrypts the credentials typed in (1)
- The target decrypts the credentials and passes them to the logon process
- The logon process does a Kerberos auth of those credentials and starts your desktop session
The last little bit is no different than when you walk up to a computer and type your credentials in physically. You can also substitute password with smart card or certificate.
The security of this exchange lies in the fact that you used Kerberos to verify the identity of the target machine is one you trust because the name matches a service in Active Directory (yes, you're delegating that trust decision, but if you can't trust AD you're screwed anyway).