Please configure your system to catch all failed Remote Desktop Connection logging information.
1. Configure "Local Security Policy"
Click the Windows "Start" button and then click "Start->Administrative tool->Local Security Policy". Set the "Audit account logon events" and "Audit logon events" to "Success, Failure".
2. Configure "RDP Security Layer". For Windows Server 2008 only. No need to do this step if you have Windows Server 2012 or later.
Click the Windows "Start" button and then click "Start->Administrative tool->Remote Desktop Services->Remote Desktop Session Host Configuration". The "Remote Desktop Session Host Configuration" window shows as follows.
Click "RDP-Tcp" and the dialog shows.
Select "RDP Security Layer" as the security layer.