Terminal Server Encryption

I am looking for information on Terminal Server encryption. I have read that Terminal Server’s own encryption makes it relatively safe over the Internet. I have also read that most folks recommend running it via VPN over the Internet.

Then I read that the encryption with TS only encrypts data, but the screen images could be captured and exploited. Well, as far I know TS does not pass data, but only key/mouse strokes and screen images! So that would make the encryption worhtless.

Okay..can some one inject a little clarity, or point me to some good information? Is it imperative to run TS via VPN over the ‘net?

Thanks!