I've got a print server in our Windows 2003 domain with a lot of print queues on it. We are seeing a significant amount of SNMP scans coming from this server which we think are unnecessary. Everything related to the print server itself is functioning fine, but the network team would like the scans to stop.
We can see the scans as they happen on the switch. I have installed Wireshark and can see the scans happen as well. I can see programs that are listening for connections via things like CurrPorts.
This server has had several maintainers over the years. There are residual drivers and things that don't need to be there. Unfortunately I can't do anything too drastic to clean things up or clean install the server because it is our primary print server our network relies on. We have plans to replace it within the next year or two.
So my question is....
How can I pinpoint which program/process on the Windows 2003 server is generating the SNMP scans?