From RPC to RCE - Workstation Takeover via RBCD and MS-RPChoose-Your-Own-Adventure : In the default configuration of Active Directory, it is possible to remotely take over Workstations (#Microsoft #Windows 7/10/11) and possibly servers (if Desktop Experience is installed) when their WebClient service is running.

https://gist.github.com/gladiatx0r/1ffe59031d42c08603a3bde0ff678feb