Issue: user locks RDP session using Win+L, then network is lost for some littile time (for example ethernet cable is disconnected for a minute). After that terminal session reconnects and unlocks without asking password.
WTware knows nothing about lock using Win+L.
WTware sees that connection is lost and reconnects. Thanks to Microsoft, who added into RDP reconnection without password when network connection is lost.
Why after reconnecting server unlocks locked screen - question to Microsoft.
Microsoft doesn't see the problem in it, cause local Windows intercepts Win+L and blocks locally, but not sends it into RDP session.
Easy solution - never lock by Win+L.
Correct solution - disable on server reconnection without password: https://kb.cert.org/vuls/id/576688/