3.3.5.10.2 Sending Early User Authorization Result PDU
The structure and fields of the Early User Authorization Result PDU are described in section 2.2.10.2. If the PROTOCOL_HYBRID_EX (0x00000008) flag was specified in the requestedProtocols field of the RDP Negotiation Request (section 2.2.1.1.1) structure, and the server set the selectedProtocol field of the RDP Negotiation Response (section 2.2.1.2.1) to PROTOCOL_HYBRID_EX, then the server SHOULD authorize the user (once the CredSSP (section 5.4.5.2) handshake has completed) and then indicate the result of the authorization by using the Early User Authorization Result PDU. If it is to be sent to the client, the Early User Authorization Result PDU MUST be sent before any post-handshake PDUs are transmitted (section 5.4.2.1 and 5.4.2.2).