
Under windows you can connect to a child session by requesting a named pipe to the local server, and then do some RDP on this named pipe. The protocol is like for /vmconnect with CredSSP, then Nego and then the "normal" workflow for a connection. For CredSSP we force the usage of NTLM for the Negociate SSPI, and the credentials are empty.