On Windows systems, disabling RDP via the registry generates registry write events. Investigate registry event logs for modifications under the Terminal Server configuration path. What is the name of the registry value that was changed to disable Remote Desktop Protocol?

DeviceRegistryEvents
| where RegistryKey has "Terminal Server"
| where ActionType == "RegistryValueSet"
| where RegistryValueData == "0"
| project RegistryValueName

DeviceRegistryEvents
| where ActionType == 'RegistryValueSet'
| where RegistryKey contains 'Terminal Server'
| project TimeGenerated, DeviceName, InitiatingProcessFileName, RegistryKey, RegistryValueName, RegistryValueData

DeviceRegistryEvents
| where ActionType == "RegistryValueSet"
// Terminal Server config path (handles CurrentControlSet/ControlSet00x) and policy path
| where tolower(RegistryKey) has @"\control\terminal server"
   or tolower(RegistryKey) has @"\software\policies\microsoft\windows nt\terminal services"
| extend NewValue = tostring(RegistryValueData), OldValue = tostring(PreviousRegistryValueData)
| extend NewValueNorm = trim(' ', tolower(NewValue))
// Either the specific value name or any write that clearly set it to disabled (1)
| where tolower(RegistryValueName) == "fdenytsconnections"
   or NewValueNorm in ("1","0x1","0x00000001","dword:00000001")
| project TimeGenerated, DeviceName, RegistryKey, RegistryValueName, OldValue, NewValue,
          InitiatingProcessAccountDomain, InitiatingProcessAccountName,
          InitiatingProcessFileName, InitiatingProcessCommandLine
| order by TimeGenerated desc

DeviceRegistryEvents
| where TimeGenerated between (startofday(ago(30d)) .. now())
| where tolower(RegistryKey) has_any ("terminal server", "currentcontrolset\\control\\terminal server", "winstations", "rdp-tcp", "termsrv")
| where ActionType has_any ("set", "setvalue", "write", "modify", "registryvalueset", "registryvaluechanged")
| extend ChangedValueName = tolower(coalesce(RegistryValueName, PreviousRegistryValueName))
| extend NewValue = tostring(RegistryValueData), OldValue = tostring(PreviousRegistryValueData)
| where isnotempty(ChangedValueName)
| where ChangedValueName in ("fdenytsconnections", "userauthentication", "fallowtogethelp") or ChangedValueName contains "deny" or ChangedValueName contains "allow" or ChangedValueName contains "auth"
| project TimeGenerated, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, ActionType, RegistryKey, ChangedValueName, OldValue, NewValue
| order by TimeGenerated desc
| take 100

let TerminalServerKey = "SYSTEM\\CurrentControlSet\\Control\\Terminal Server";
DeviceRegistryEvents
| where TimeGenerated >= ago(7d)
| where RegistryKey has (TerminalServerKey) or RegistryKey has "CurrentControlSet\\Control\\Terminal Server" or RegistryKey has "Terminal Server"
| where RegistryValueName in ("fDenyTSConnections", "fDisableRDP")
| where ActionType in ("RegistryValueSet", "RegistryValueModified", "RegistryValueWrite", "RegistryValueCreated")
| project TimeGenerated, DeviceName, DeviceId, RegistryKey, RegistryValueName, RegistryValueData, PreviousRegistryKey, PreviousRegistryValueName, ActionType, InitiatingProcessFileName, InitiatingProcessCommandLine
| sort by TimeGenerated desc

DeviceRegistryEvents
| where Timestamp > ago(30d)
| where ActionType == 'RegistryValueSet'
| where RegistryKey contains 'Terminal Server'
| project Timestamp, DeviceName, RegistryKey, RegistryValueName, RegistryValueData
| order by Timestamp desc

DeviceRegistryEvents
| where RegistryKey has "\\Control\\Terminal Server"
| where ActionType in ("RegistryValueSet", "RegistryValueModified", "RegistryValueUpdate")
| where RegistryValueName == "fDenyTSConnections"
| project TimeGenerated, DeviceName, ActionType, PreviousRegistryValueData, RegistryValueData, InitiatingProcessAccountDomain, InitiatingProcessAccountName, InitiatingProcessCommandLine, RegistryKey
| order by TimeGenerated desc

// --- RDP disabled via registry investigation
DeviceRegistryEvents
| where RegistryKey has "\\Control\\Terminal Server"          // Terminal Server branch
| where ActionType in ("SetValue",               // MDE normalised action types
                       "RegistryValueSet",
                       "RegistryValueModified",
                       "CreateValue")
// timerange placeholder will be injected by the calling function
// | where TimeGenerated between (datetime_start .. datetime_end)
| project TimeGenerated,
          DeviceName,
          ActionType,
          RegistryKey,
          RegistryValueName,
          PreviousRegistryValueData,
          RegistryValueData,
          InitiatingProcessAccountName,
          InitiatingProcessFileName,
          InitiatingProcessCommandLine
| extend DisabledRDP = iff(RegistryValueName == "fDenyTSConnections" and RegistryValueData == "1", "Yes", "No")
| summarize FirstSeen=min(TimeGenerated),
            LastSeen=max(TimeGenerated),
            EventCount=count() 
          by DeviceName, RegistryValueName, DisabledRDP, RegistryKey
| order by LastSeen desc

DeviceRegistryEvents
| where RegistryKey has "Terminal Server"
| where ActionType =~ "RegistryValueSet"
| summarize EventCount=count() by RegistryValueName
| order by EventCount desc

DeviceRegistryEvents
| where RegistryKey has "Control\\Terminal Server"
| where ActionType has "RegistryValueSet"  // Adjust this filter if needed to capture modification events
| summarize count() by RegistryValueName
| order by count_ desc
| project RegistryValueName, Count = count_