We use AVG Business. The Firewall has the option to change the default rules applied for it.
Some of our windows servers have different ports for RDP than the default settings. When we change the rules to allow these ports, the firewall will allow access for a few hours, then revert back to the default 3389 port only. There seems to be no way to stop this behaviour.