In my Admin event log, I see the following errors:
The Terminal Server security layer detected an error in the protocol stream and has disconnected the client. Client IP: XXX.XXX.XXX.XXX
Sometimes I see IP's here that I don't believe should have access to my server. The server is 2008 R2, uses NLA and sits behind a robust network Firewall. I do NOT see any Security Events (either Successful or Failed) of these IP's authenticating, which leads me to believe they were not authenticated to begin with, but I am not positive. I also do not see any RDP\Terminal Logon or Disconnect events from these IPs.
How would I go about finding more information about these events after they've already happened?