Remote Desktop failed logon event 4625 not logging correctly on 2008 Terminal Services server
- by Zone12
When I use the new remote desktop with ssl and try to log on with bad credentials it logs a 4625 event as expected. The problem is, it doesn't log the ip address, so I can't block malicious logons in our firewall. The event looks like this:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
…
