Actually, they can. The RDP client does not care what the clients non-routable IP may be, it depends only on the public IP of the client. Unfortunately, I cannot find a method that will return that either. WTSManager, which apparently is just a COM wrapper for some WTS methods, returns only the clients IP.