I've installed some new networking equipment: firewall, switches, vlans, etc. I won't mention the brand name here, because I don't want to cause them harm by my suspicions.
Right after doing this, I was able to RDP to a server inside my LAN without being prompted for a finger print change.
One day later, however, as I try to connect to that same server, it is now prompting me to accept a new certificate because the fingerprint has changed.
I have a suspicion that the new networking equipment is trying to gather the credentials of my servers by intercepting my RDP sessions in a manner that would be otherwise transparent except for the fact that I'm being prompt to accept a changed certificate.
How can I confirm that this finger print change's source is something that has occurred on the server I'm connecting to, and not due to the new networking equipment trying to do a man in the middle attack to catalog credentials on my network (that it should not be curious about)?