<p><pre><code>  Windows 10 hosts running RDP services fail to prevent remote logon to accounts that have
  no passwords set.

  An attacker could exploit this vulnerability by using an older version of the RDP client
  to connect to the Windows 10 host. Once connected, the attacker could generate a list of
  user accounts on the host and attempt to log on as those users. If one of the user
  accounts has no password set, then the attacker is allowed to log on as that user, 
  despite the default system setting that restricts access to accounts without passwords to
  local logon only.
</code></pre>
Is the user enumeration a feature and not a vulnerability of its own?