The TS_SECURITY_HEADER1 structure is attached to all client-to-server traffic when the Encryption Level selected by the server (see sections and ) is ENCRYPTION_LEVEL_LOW (1), ENCRYPTION_LEVEL_CLIENT_COMPATIBLE (2) or ENCRYPTION_LEVEL_HIGH (3). It is attached to all server-to-client traffic when the Encryption Level is ENCRYPTION_LEVEL_CLIENT_COMPATIBLE (2) or ENCRYPTION_LEVEL_HIGH (3).