Event ID 56, TermDD

"The Terminal Server security layer detected an error in the protocol stream and has disconnected the client."

http://blogs.technet.com/b/askperf/archive/2010/03/25/the-curious-case-of-event-id-56-with-source-termdd.aspx


To decipher the codes, you can download Err.exe from:
http://www.microsoft.com/downloads/details.aspx?familyid=be596899-7bb8-4208-b7fc-09e02a13696c&displaylang=en

113996 INFO: Mapping NT Status Error Codes to Win32 Error Codes
http://support.microsoft.com/default.aspx?scid=kb;EN-US;113996

From command prompt navigate to the downloaded/extracted err.exe

Just open the event in event viewer and copy the Binary Data "in words"

for example:  output for "err 0032000AD0"