windows-server-2008-r2 – 远程桌面登录失败事件4625未记录2008终端服务服务器上的IP地址

<Event xmlns="http://scheR_971_11845@as.microsoft.com/win/2004/08/events/event">
    <System>
        <Provider Name="Microsoft-Windows-Security-AudiTing" Guid="{00000000-0000-0000-0000-000000000000}" /> 
        <EventID>4625</EventID> 
        <Version>0</Version> 
        <Level>0</Level> 
        <Task>12544</Task> 
        <Opcode>0</Opcode> 
        <Keywords>0x8010000000000000</Keywords> 
        <TimeCreated SystemTime="2012-04-13T06:52:36.499113600Z" /> 
        <EventRecordID>467553</EventRecordID> 
        <Correlation /> 
        <Execution ProcessID="544" ThreadID="596" /> 
        <ChAnnel>Security</ChAnnel> 
        <Computer>ontheinternet</Computer> 
        <Security /> 
    </System>
    <EventData>
        <Data Name="SubjectUserSid">S-1-0-0</Data> 
        <Data Name="SubjectUserName">-</Data> 
        <Data Name="SubjectDomainName">-</Data> 
        <Data Name="SubjectlogonId">0x0</Data> 
        <Data Name="TargetUserSid">S-1-0-0</Data> 
        <Data Name="TargetUserName">notauser</Data> 
        <Data Name="TargetDomainName">MYSERVER-PC</Data> 
        <Data Name="Status">0xc000006d</Data> 
        <Data Name="FailureReason">%%2313</Data> 
        <Data Name="SubStatus">0xc0000064</Data> 
        <Data Name="logonType">3</Data> 
        <Data Name="logonProcessName">NtLmSsp</Data> 
        <Data Name="AuthenticationPackagename">NTLM</Data> 
        <Data Name="WorkstationName">MYSERVER-PC</Data> 
        <Data Name="Transmittedservices">-</Data> 
        <Data Name="LmPackagename">-</Data> 
        <Data Name="KeyLength">0</Data> 
        <Data Name="ProcessId">0x0</Data> 
        <Data Name="ProcessName">-</Data> 
        <Data Name="Ipaddress">-</Data> 
        <Data Name="IpPort">-</Data> 
    </EventData>
</Event>

看起来因为登录类型是3而不是像旧的rdp会话那样10,所以不存储ip地址和其他信息.

我试图连接的机器是在互联网上,而不是与服务器在同一网络上.

有谁知道这些信息的存储位置(以及登录失败时生成的其他事件)？

任何帮助都感激不尽.