RDPScan from linux can only scan CREDSSP/NLA if enabled and not if its patched aka SAFE

[bitking]

When a client has CredSSP/NLA Enabled the output from rdpscan can only be "SAFE - CredSSP/NLA required" since the linux node you are scanning from is not in the domain of the scanned computer. So in other words, when i patched the client i still got the result "SAFE - CredSSP/NLA required" since the node from where i am scanning is not in the domain.

Question: How can i have a reliable scan where i know the client is "SAFE" as opposed to "SAFE - CredSSP/NLA required"