Get The IP Of A RDC Dictionary Attacker....

I have to deal with a lot of dictionary attacks. One evening, I got fed up with them and decided to do something about it. So, I wrote a service in VB.NET that monitors the Windows event log. I check for too many incorrect login attempts to MS SQL.

If I find someone attempting to dictionary attack, Windows shows the IP address of the invalid login attempt in the event log. So, I parse the event message, grab the IP address, and use IPSec to block the would-be intruder. Excellent!

Ok. That takes care of SQL attackers. But, what about RDC (Remote Desktops or Terminal Services) attackers? I started using 2x's SecureRDP. It works great, but the logging feature is broken. It doesn't accurately log the attackers' IP addresses. So, how can I get the IP address of those attempting to login via RDC? Anyone know? There has to be a way.