Q:

RDP Authentication with domain credentials

There's something I don't get with RDP in a domain.  During an authentication, if we're using a local account of the distant machine, then the creds are in the SAM so all good. 
But with a domain account, how is done the comparison ?  How does RDP authentication works in this case ? 
Kindly

A:

RDP uses a protocol called CredSSP to delegate credentials.  The process works like this. 

MSTSC prompts for credentials (or uses saved creds)
MSTSC requests a network logon ticket (Kerberos or NTLM) to the machine typed into the "computer" field using the credentials from (1)
A TLS session is established with the remote machine (this is why you sometimes see the yellow dialog indicating the typed name doesn't match the certificate name)
The ticket from (2) is sent to authenticate the client machine
A response to the ticket from (2) is sent to client to authenticate the target machine
An encryption key is negotiated between the client and server
The client encrypts the credentials typed in (1)
The target decrypts the credentials and passes them to the logon process
The logon process does a Kerberos auth of those credentials and starts your desktop session

The last little bit is no different than when you walk up to a computer and type your credentials in physically.  You can also substitute password with smart card or certificate. 
The security of this exchange lies in the fact that you used Kerberos to verify the identity of the target machine is one you trust because the name matches a service in Active Directory (yes, you're delegating that trust decision, but if you can't trust AD you're screwed anyway).