RDP Authentication with Kerberos, Restricted Admin, and Pass-the-Hash

Composite source procedure for establishing an RDP interactive session via FreeRDP using password/Negotiate or Kerberos material, Restricted Admin, Remote Credential Guard, or an NTLM hash. These branches have distinct authentication, credential-delegation, and target-authorization requirements. The mapped T1550.002 applies only to the NTLM pass-the-hash branch; ordinary RDP access and actual stolen-ticket reuse have separate scopes. A successful RDP logon establishes a session as the authorized user, not proof of an elevated process.