Fairly recently too even. Iâ(TM)m just your average Windows admin and while doing other work I just happened to notice a machine being logged in sitting at a desktop when it should have been at a login screen. So I played around with it and got to where I could reliably reproduce what I had seen earlier. I wrote up step by step instructions on how I accessed a Windows system from another Windows system potentially without credentials and supplied a video showing the process from between two Windows Insider machines (one Windows server and one client OS, I showed the process in both directions). This was all per their directions in the MSRC portal. I got an email back from them that said that my findings, while providing good information, did not meet the requirements of a security vulnerability requiring servicing. I replied back from within the portal asking if this meant I had miscategorized my finding and should resubmit it with some changes, or if there was some sort of explanation for why my observation was not a security vulnerability.
I never heard back and eventually I got a request to fill out a survey so they presumably closed out my case. Itâ(TM)s been several months, I should try duplicating the issue again for my own curiosity to see if they patched it and just never credited me.