WINDOWS RDP LETS YOU LOG IN USING REVOKED PASSWORDS. MICROSOFT IS OK WITH THAT

Summary from the TLDR InfoSec newsletter

A security researcher discovered a vulnerability where Windows RDP would accept a revoked password without raising any alerts. This vulnerability occurs because when a user logs in using a Microsoft or Azure account, Windows validates the password and then caches it in an encrypted local storage, which is used for all further authentication attempts. Microsoft has responded that this is an intentional design decision to prevent users from getting locked out of a device.