There is a Windows setting that if unchecked could expose corporate RDP, even if your firewall is blocking all 3389 ports. Not only could numerous RDP ports be exposed, they will be invisible to your Cybersecurity perimeter protections.