Title says it all.
explorer isn't running so I can't grab the lock command from the start menu.
shutdown.exe doesn't seem to have any suitable option for it (shutdown -l is log off).
Windows-L would work on the local machine but gets grabbed by the local machine before it gets a chance to flow down RDP to the remote machine.
Should have a tag windows-core but it doesn't exist.
Run the Win32 API LockWorkStation function from the command prompt:
rundll32.exe user32.dll,LockWorkStation
Source: Changing Computer State in PowerShell section of MSDN
Note that this is officially unsupported because LockWorkStation has a signature different from the function signatures that rundll32.exe supports, which leads to corruption of the process’s stack.
Since Windows Vista, rundll32.exe contains a hack to contain reasonably small stack corruption and recover from it. Still, this is not free license to abuse rundll32. Such abuse leads to similar hacks, which generally complicate things and would otherwise be unnecessary.
Use this at your own risk, or better not at all.
Having not received any answers than the one by Art. Vandelay05, that is rundll32.exe user32.dll,LockWorkStation that is a bad idea Throwing garbage on the sidewalk: The sad history of the rundll32 program, I've come to the conclusion there is no known good way.
Therefore I will deploy this C program:
#include <windows.h>
DWORD CALLBACK RawEntryPoint(void) { return !LockWorkStation(); }
Nice little program needing only kernel32.dll and user32.dll.