Edges
RemoveInteractiveLogonRight
From Principal to Computer. Principal has the SeRemoteInteractiveLogonRight on the Computer.
For RDP access the principal also needs membership in the computer’s local Remote Desktop Users group, which related to the edge MemberOfLocalGroup. When RDP access is possible, the principal will have the edge CanRDP.