Your comments

100% this - we don't want to take away screenshots in general for technicians, however there are certain sessions where we need to disable/hide screenshots.

Better late than never... This is the syntax you'd want to use:

  FirstEventTime > $4DAYSAGO

(You can replace 4 with whatever number you want.)

Definitely agree with this. We support lots of RDS and WVD multi-session hosts and this would be a really valuable addition.