Wow, thanks for the quick reply. I was doing a lot of testing to find this and somehow somewhere I edited group policy of the computer (Im guessing) and in one of the SO testing I got an event ID 140 in /app serv logs/Microsoft/windows/RemoteDesktopServices-RdpCoreTS/Operational, where it says the bad login and ip address too! but at this point I do not know for sure that I changed, since I test the same on fresh SO and that ID error wont be logged. I will keep trying 🙂 thanks for your reply again