I have noticed that when a failed login attempt happens when someone is trying to remote desktop into that machine the IP is 127.0.0.1  Which is the localhost what a person would actually need in this situation is the IP address that was trying to remote in.  Any possible way you can do that?

Thanks

Curtis