RDP Enable or Disable via Win32_TerminalServiceSetting WMI Class (4b8f6d3a-9c5e-4f2a-a7d8-6b9c3e5f2a8d)
Detects enabling or disabling of Remote Desktop Protocol (RDP) using alternate methods such as WMIC or PowerShell. In PowerShell one-liner commands, the "SetAllowTSConnections" method of the "Win32_TerminalServiceSetting" class may be used to enable or disable RDP. In WMIC, the "rdtoggle" alias or "Win32_TerminalServiceSetting" class may be used for the same purpose.