rpcclient Access Denied: SAMR and LSARPC Boundaries
Record an rpcclient access denial at the specific procedure and account context that failed. Use the evidence card to distinguish connection success from per-call permissions and keep other successful queries within their own scope.