I agree with Justin, that it sounds like an Active Response is being triggered when a user initiates an RDP session. I'd recommend raising a Technical Support ticket - they can drill into the rules to determine if an active response is triggering, as well as the LEM appliance and agent logs to determine the root cause.
↧