Disabling or detecting the use of Desktop Duplication API

Question

We provide software that locks down devices in order to ensure the user remains within our application, and that they don't have access to any outside resources. One class of software that we block is remote desktop clients. We block this through several means, including blocking specific remote desktop applications, as well as using CreateDesktopW to create a private desktop for our application to operate within.

However, remote desktop applications that use the Desktop Duplication API (https://learn.microsoft.com/en-us/windows/win32/direct3ddxgi/desktop-dup-api) in order to access the screen seem to still be able to operate. Is there any way to disable this API, or to detect when it is being used?

We have already considered the following, but not found a viable path yet:

• Group Policy Settings: There are Group Policy settings relevant to remote access, but nothing specific to the Desktop Duplication API. Even after updating the Group Policy settings, we are still able to remotely access the device through e.g. Sunshine remote desktop
• Windows Security Auditing: Windows Security Auditing doesn’t provide a way to list processes attempting to use the Desktop Duplication API. While processes attempting to access dxgi.dll can be detected, there are many legitimate uses of this DLL, which would lead to false positives.
• Kernel-Level Hooks (Advanced and Risky): We consider this a last resort.