STAS DCOM errors 10028 spamming my PDC

Question

Since installing STAS/XG/interceptX i've noticed my domain computers are taking ages to login. I've disabled interceptX to rule it out (i know this is the authentication group) and had a look at my domain controllers event logs. 
 I have STAS installed on both my PDC and BDC and configured a per this guide; 
 How to Implement Clientless SSO with multiple Active Directory Domain Controllers 
 The event log on my PDC shows the following errors;

My BDC-server doesn't have these errors 
 I 've found a post with a similar issue, however the range of IPs i have an issue with are all NON windows devices. Chromebooks, printers, tablets etc. With the ranges totally different to those set in STAS 
 Similar issue 
 Any ideas? 
 thanks in advance.

sachingurung · Accepted Answer

Hi John, 
 The DCOM error is generated for the IP Address 192.168.60.38 which is not specified in the monitored network. This is a known behavior and the developers are working on a fix. This issue is taken up in the reference ID, NC-27245 . 
 Thanks,

sachingurung · Answer

The issue is not completely caused due to STAS but when STAS is queried by the access_server. When unknown traffic is generated, access_server reads it and sends a workstation polling request to STAS. STAS tries to map the IP address with the logged in User which fails, due to this a WMI request is made to these IP addresses, which also fails. Which results in a DCOM error. This information can be read in the KB article here , read the point 6,7 and 8 in How STAS works section. 
 Thanks

MasterRoshi · Answer

Hey guys, 
 Check my responses in this thread which was for the same issue https://community.sophos.com/products/xg-firewall/f/authentication/110642/dcom-errors-in-the-thousands/396485#396485 for ways to reduce the number of these errors.

Aditya Patel · Answer

Hello JohnHilton, 
 At the moment we do have an option to add a IP range for STAS exclusions, you can manage the range in your subnet and assign them to a smaller subnet range. 
 e.g. Network Range 192.168.0.1/24 by adding the range of IP not to be managed by STAS you can assign a Static DHCP and determine that last 14 IP will be added in exclusion so you can add 192.168.0.240/28.

Joan Miquel Gurdo · Answer

Hi, 
 Even if you have good configured the exclusions (Printers, NAS ...) ... 
 
 On Windows 2019 (probably 2016) the DCOM error is fired too when the XG ask the collector about one Windows PC IP and this PC is off. 
 It seems someting like the logof detection not work correctley or in some cases. 
 When the involved PC goes on the errors stop. 
 
 I observed this only on windows 2019, in a domain whith 2 DC'S one winows 2019 and another 2008R2 this only happends on the 2019 DC if he is the primary. No errors if the primary is the 2008R2. 
 
 Regards.