We use the MS RDP encryption, on High mode.
The High setting mode encrypts data sent from the client to the server and from the server to the client by using strong 128-bit encryption.
Use this encryption level in environments that contain only 128-bit clients (for example, clients that run Remote Desktop Connection).
Clients that do not support this encryption level cannot connect to RD Session Host servers.
However we don't use RDP certificated as they are dependent on RDS roles.