Sophos Central [Peripheral Control] - Issue with User-Based Policy

Question

I have created a user-based policy; with the intention to block USB Storage Devices. 
 It is configured to apply to a specific AD Group only; for example {students} 
 When a user (member of {students}) logs in, the policy is applied and USB devices are blocked... 
 However, once they log out and a another user logs in (NOT a member of {student} group) USB devices are still blocked. 
 Upon checking Sophos Central, it has picked up the correct logged in user and required policy (e.g. not to block) but it stays blocked! 
 Sophos Tech Support assisted for 2 hours last week, and suggested that the end-user would have to do a forced, manual update of Sophos End-Point to ensure the correct policy was being applied (this does not work - and would not be a workable solution anyway!). 
 I've now had Sophos Tech Support on a remote session, attempting to identify / resolve this issue for the past 3 hours, and it's still not looking promising. 
 Coincidentally, [Application Control] appears to work, as I would expect [Peripheral Control] to work, as in (on the whole) the correct policies 'are' being applied based on the logged in user. 
 As this rate, I think I may have to stop using Sophos Central for peripheral control and use Group Policy instead! 
 
 Any assistance would be appreciated; even if other users could check and advise how [Peripheral Control] policies are working with their environment.

jak · Answer

It works OK for me but it can be slow? For example, as a test: 
 
 User1 - Device1 
 User2 - Device1 
 
 Create 2 user based peripheral policies: 
 
 Policy1 - Block removable storage 
 Policy2 - Allow removable storage 
 
 Link the "block" policy to "user1" and link "user2" to "allow" policy. 
 Log into the endpoint as user1, shortly after, if a USB device is inserted it will disappear in Explore as it is disabled. 
 Log into the endpoint as user 2. At this point, MCS Client will see the change of user (see the line in the MCSClient log file) and send this new info to Central. Central will then send down the policies for user 2. At this point the policy is applied, SAV will re-enable the device and it will be available in Explorer. 
 If user 2 logs off, user 1 logs on, again MCS Client will notice the change of user, send up the details and Central will send down the policies for user 1 before SAV is reconfigured. 
 The process does rely on a round trip message to Central so can take potentially minutes. 
 I would suggest enabling MCS Message Trails https://community.sophos.com/kb/en-us/119608 and you should see the XML policy file (...SAV16.xml) arrive. It is cached here: %ProgramData%\Sophos\Remote Management System\3\Agent\AdapterStorage\SAV\DEVCAdapterConfig. 
 I would say the first step in troubleshooting this issue is to monitor when the policy arrives for the user and how long it takes. 
 Regards, Jak