What exploitation issues arise when combining hidden accounts with remote desktop multi-user login?
When you clone an existing account's permissions to create a hidden account, the cloned account inherits the original account's identity. If the original account is already logged in (e.g., via RDP), logging in with the hidden clone will kick the original user out because the system sees them as the same account. This behavior is similar to the conflicts described in Penetration Techniques - Multi-user Login for Windows Remote Desktop. Additionally, if you clone a disabled Administrator account, the hidden account will also be disabled.
remote desktopmulti-user loginaccount conflictcloning exploitation