copying from table in 2.2.6.4: Value returned from server is ENCRYPT_OFF: Encrypt login packet only
copying from 3.2.5.2:
If login-only encryption was negotiated as described in section 2.2 in the PRELOGIN message description, then the first TDS packet of the Login message MUST be encrypted using TLS/SSL and encapsulated in a TLS/SSL message. All other TDS packets sent or received MUST be in plaintext.