When I start a remote connection to a unattended Windows host, it brings me to the login screen for the host. I will then need to enter a Windows username/password to gain remote access.
However, when I start a File Transfer connection to the same host, if a user has been logged in (but machine locked / sat at login screen) I can manipulate the files without logging in to Windows.
I'm coming to TV from LogMeIn, which requires a Windows password to the host regardless of what type of connection.
Technically, if my TV account was compromised, nobody could gain remote control of any hosts I was connected to, however they would get full access to files for every host linked to my account.
The hosts are all on different domains so the requirement for a domain username/password adds a considerable layer of security.
I have tried to use 'File Transfer after accepted on host', however you can not click the 'Allow' box from the remote session.