RDP Restricted Admin Mode Enabled - Registry Key Detection
This query capture the activity in the event the registry key that controls RDP Restricted Mode is enabled or disabled.
SentinelOne

This query capture the activity in the event the registry key that controls RDP Restricted Mode is enabled or disabled.

Already have an account?