RDP enabling/disabling events are not properly reported by EDR.
Setting fDenyTSConnections to 1 which disables RDP is wrongly reported in "EDR as RDP Enable"
Setting fDenyTSConnections to 0 which enables RDP is not reported at all
This issue is caused by how SEP generates these logs
The IntelliFilter rules included in SEP client 14.3 includes an updated rule which detects enabling RDP, instead of disabling RDP.