Can confirm this as well.
The target OS does not seem to matter but I have specifically confirmed this behavior on WinXP, Win7, Win2008R2, Win2012.
Below is the syslog event.
Code:
Log Name: System
Source: TermDD
Date: 08/19/2014 09:13:13 AM
Event ID: 50
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: XXXXX
Description:
The RDP protocol component "DATA ENCRYPTION" detected an error in the protocol stream and has disconnected the client.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="TermDD" />
<EventID Qualifiers="49162">50</EventID>
<Level>2</Level>
<Task>0</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2014-08-19T14:13:13.165593700Z" />
<EventRecordID>167398</EventRecordID>
<Channel>System</Channel>
<Computer>XXXXX</Computer>
<Security />
</System>
<EventData>
<Data>\Device\Termdd</Data>
<Data>"DATA ENCRYPTION"</Data>
<Binary>0003040002002C000000000032000AC00000000032000AC00000000000000000000000000000000092010000</Binary>
</EventData>
</Event>