Windows RDP-Related Event Logs: Identification, Tracking
https://ponderthebits.com/2018/02/windows-rdp-related-event-logs-identification-tracking-and-investigation/
Feb 20, 2018 . 1) When NLA is enabled, a failed RDP logon (due to wrong username, password, etc.) will result in a 4625 Type 3 failure. When NLA is not enabled, you *should* see a 4625 Type 10 failure. 2) Both of these entries also contain a “SubjectLogonID” or a “TargetLogonID” field.
DA: 66 PA: 53 MOZ Rank: 17