I am using your excellent ts_blocker, release 20120530, on my server 2008 R2 Enterprise. it works very fine, i use the vbs script, launched with wscript.

The only problem is that is does not work for users attempting to connect RDP from a mac intosh. With this machine the distant IP seems to be not recognized when the login fails. The IP is visible when the login is good (event ID 4624) but not when it fails (Audit failure event ID 4625) : then the IP is not to be seen in the event log ! In the "network information" of the event log entry is nothing given.

Have you already been told of that and is there something to do ?