@mttaggart @wdormann
Also pretty much yes. Without setting up extra group policies
Further to this, the cached creds even sync to your new devices. So if you setup a fresh install and sign in with ms account. There is a chance your old creds will sync to the new install and become useable for rdp login
Pure insanity, I imagine that not even Microsoft truely understands the full nature of this problem.