I am registering all RDP logon failures on my Windows servers through the IP address. In Windows Server 2012 R2, in Event 4624 the Event Viewer shows me the IP, while in Event 4625 it does not. I tested it on Windows 10 and it shows me the IP in the 2 events. Is there any way to have access to the IP address in Windows Server 2012 R2 without compromising the security of it? Does it have anything to do with the NTLM authentication method?
EDIT: I installed the Syspeace program and the same can find the IP's, so it is possible. Anyone have any ideas?