Screenshot (Not Connected)

You can perform a screenshot of the login page of the remote host using RDP with CrackMapExec if NLA is disabled

# crackmapexec rdp <ip> --nla-screenshot