powershell "start the following program at logon" yields this result:
Copy&paste from the accepted answer:
$ou = [adsi]"WinNT://127.0.0.1"
$user = $ou.psbase.get_children().find("test")
powershell "require users permission" yields this result:
$user = [ADSI]"LDAP://CN=UserName,DC=Contoso,DC=Com"
Or, from the same thread using the Quest active directory tools:
Get-QADUser Kazun | Set-QADUser -TsRemoteControl 2
Possible values for RemoteControl:
Disable 0 (0x0)
Remote control is disabled.
EnableInputNotify 1 (0x1)
The user of remote control has full control of the user's session, with the user's permission.
EnableInputNoNotify 2 (0x2)
The user of remote control has full control of the user's session; the user's permission is not required.
EnableNoInputNotify 3 (0x3)
The user of remote control can view the session remotely, with the user's permission; the remote user cannot actively control the session.
EnableNoInputNoNotify 4 (0x4)
The user of remote control can view the session remotely, but not actively control the session; the user's permission is not required.