RDP Restricted Admin Mode Enabled - Registry Key Detection

This query capture the activity in the event the registry key that controls RDP Restricted Mode is enabled or disabled.

SentinelOne