Screenshot Without NLA (not connected)

You can perform a screenshot of the login page of the remote host using RDP with NetExec if NLA is disabled

# NetExec rdp <ip> --nla-screenshot