Windows security events of Login Failure type are generated for NLAUser account on Active Directory Server when AD credentials validation is performed from:
RAS Console > Farm Enrollment Servers > AD Integration > Validate AD Integration Settings
The following warning from RAS Console is observed:
Deny log on though Remote Desktop Services is applied not only to RD Session Hosts but to Active Directory server itself.
Reconfigure policies as described in the following article