Have you looked at Application Rules in the Firewall to see how many connections there are for Microsoft?