What is the most ready way to log the PID and process name of anything making an outbound connection on port 25? This is on a 2008 x32 server without the windows firewall enabled.
I'm decommissioning and old mail server and unfortunately a lot of the processes were defined by hand pointing to this host. I've got over 90% of the configuration updated but the remainder is a bit of a mystery.
I was thinking about using the following but it'll generate a lot of noise since this is a web server. I'm also not sure if it would work since the windows firewall is disabled.
auditpol /set /subcategory:"Filtering Platform Connection" /success:enable /failure:enable