jknight - a forcefully rejected connection is usually a firewall. Can you sniff it and determine if a TCP connection is actually happening, and data is exchanged (indicating auth failure/some other failure), or if you get an immediate RST on the connection attempt (inidicating firewall/service not avail/wrong server)?
No firewall between these two devices.
I don't see anything in my Event log on the Mail Server pointing to a denial of SMTP. But what you are saying is pointing me into a direction of my Virus Protection. It could be blocking the tool. I'm going to do some digging.