technique://RDP

RDP and WinRM both accept a blank Administrator password — attack surface is two services wide when credential assumptions fail at the front door.