Scenario:
User runs as local admin (why is outside of the scope of this scenario)
Tech port forwards to user's workstation to expose RDP
Aside from creating a strong password for user, tech does nothing else to secure RDP access
Software support for a specific program is allowed in by user and creates a new admin account with a weak password for the user to test
Password is guessed/brute forced from the web and computer is compromised.