capture windows named pipe traffic such as \pipe\lsarpc, \pipe\netlogon, \pipe\samr

I have a server that has named pipe such as \pipe\lsarpc, \pipe\netlogon, \pipe\samr,

I need to decommission the server and wanted to know if any clients are still connecting thru those named pipes and which clients are connecting via it and doing what.

And also to see if any clients are still be authenticated thru that server.

Appreciated very much for any assistance.