I have a few servers that I keep getting the EventID error 5605
The root\cimv2\TerminalServices namespace is marked with the RequiresEncryption flag. Access to this namespace might be denied if the script or application does not have the appropriate authentication level. Change the authentication level to Pkt_Privacy and run the script or application again.
The issue is I have no clue where this script is being run from so I can't update the script to solve the issue like every other post I have found on Event 5605. I checked the GPO for startup scripts, I checked all of my domain's SYSVOL share for a VBScript or Powershell script. I can't find this script anywhere. How can I track down this script and fix it so it stops throwing this error?