Thanks for the reply jrouviere.
The default rules/filters are enabled. We have not made any correlation as such specific to Logon & Logoff events.
We are not able to get any information from logs why it is happening.
If LEM service on the agent is in running status for that node after successful RDP login the RDP session automatically gets logged off within seconds or sometimes in minutes. Once we stop the running LEM service the RDP session lasts until manually logged off. Due to this the nodes are in disconnected status.
It has something to do either with Solarwinds Agent services or with Windows. I am not sure.
If you have any pointers to work on let me know
Thanks.