RDP failed logons not showing as 4625 Type 10

Hey Everyone, 

Does anyone know why failing an RDP logon on my servers would generate a 4625 Type 3 (Network) instead of Type 10? Doesn't seem to matter why...even if I mistype a password with a valid account...or try an account that doesn't exist. Happens on 2008 and 2008 R2 for sure but havent tried anywhere else. If I log in successfully its a 4624 Type 10. I need to distinguish if someone failed via RDP for security purposes.  

Starting to think 4625 type 10 doesn't exist, only 4624 has it as a type.

Thanks!