I'm trying to track down a problem where something is causing my active directory account to get locked out. I think that I could figure it out if I can log all connections to 2 specific servers.
I want to log all outgoing TCP connections (maybe UDP also) to servers X and Y along with what process initiated the connection (PID, EXE path, & full command used to start the process). How do I do that?
I tried TCPView, but that only shows me current TCP connections. I want connections from the past 15 minutes, even if they've already died.