Checking the encryption level of Remote Desktop on Windows Server 2012
You've got to trace it and this can be done in Windows.
C:\Windows\System32> netsh trace start capture = yes ipv4.address = <IP>
Running
Trace File: <filepath>\NetTrace.etl
C:\Windows\System32> mstsc -v <IP>
C:\Windows\System32> netsh trace stop
Tracing session was successfully stopped.
Open the saved NetTrace.etl file Microsoft Message Analyzer and look for the Client Handshake
Update for newer Windows versions
Since Message Analyzer got retired, the only alternative as of 2021 is to use pktmon and if you can install extra tools, use netmon.
Also, it is possible to use wireshark by converting the files to pcap format.