Screenshot Without NLA (not connected)

You can perform a screenshot of the login page of the remote host using RDP with NetExec if NLA is disabled

nxc rdp <ip> --nla-screenshot