STAS users randomly disconnecting

Can you please post Screenshots of your Config.

Please both appliances. And Explain the IP addresses. 

MBP, and STAS agent (192.168.0.5) screenshots.

All tests to itself as an agent and to 192.168.0.6 the Collector and Sophos were successful

Hi,

i do not talk about the WMI Test in Collector.

I talk about wmic over CMD on the DC.

Please perform those tests instead of the WMI test on the collector tab. 

Ah, apologies,

You mean these commands?

C:\WINDOWS>wmic

wmic:root\cli>/user: <DOMAIN>\administrator
Enter the password :********
wmic:root\cli>/node: <IP-ClientPC>
wmic:root\cli>computersystem get username /value

Yep, I have run those and they all work.

I will get a screen shot for you.

Yep the WMIC commands comeback as successful from the client to the DC

Are these the STAS settings from the XG you mean? 

Thanks MBP,

Here is a screenshot of the WMIC commands.

It is from the collector DC (192.168.0.6), in the domain PRIMARY, for user test321, on client PC 192.168.4.121

Thanks, as always

Update:

Within 20-30min of taking this screenshot the user test321 disappeared from STAS > Show Live Users.

Whilst still connected and surfing the internet.

After Logout, do you get the same output out of WMIC? 

Nope.

I get

UserName=

This is the reason for STAS not working.

Your Windows Setup is not working properly. WMI Should give you the correct user. 

Try to find some information about how to debug this in the Microsoft community because STAS only relies on WMI Technology. 

Sorry MBP, I miss read your question.

I logged out of the client and got

UserName=

You meant, when STAS kicked me off but I am still logged into the client.

I shall try it again.

Apologies

I logged user test321 out of client 192.168.4.121 and logged in user Mat Edwards to client 192.168.4.121

WMIC reflected this correctly.

Within minutes Mat Edwards dropped out of Show Live Users.

WMIC shows him as still logged in (which he is)

Also STAS still shows test321 as logged in (which he is not). The 605sec Log off Detection Interval has passed.

I logged user test321 out of client 192.168.4.121 and logged in user Mat Edwards to client 192.168.4.121

WMIC reflected this correctly.

Within minutes Mat Edwards dropped out of Show Live Users.

WMIC shows him as still logged in (which he is)

Also STAS still shows test321 as logged in (which he is not). The 605sec Log off Detection Interval has passed.

I believe, with the advice from Sachin and Aditya, the problem is solved.

1. It was a combination of the NTP server not being set correctly (by the Sophos expert who initially setup the XG!)

2. One of the domain controllers not being in a server group (on the XG) with a rule applied to stop ip address 'masquerading'.

This resulted in the Kerberos Event 4768 on the dc showing the user with the IP address of the XG!  

 I will monitor the situation and many thanks again.

Unfortunately, the problem is not solved.

Although the situation is more stable, users are still disconnecting randomly.

Perhaps after 20-30 minutes instead of 5 minutes.

Hi Mathew,

Did you upgrade to the latest STAS software version as I suggested you via DM? If the update didn't resolve the issue, you may raise a case with our support and provide the details.

Thanks,

Version 2.2.1.0 ?  if so, this version is more than 18 month old.

Paul Jr

I believe 2.2.3.0 is the current release.

The version I can download is 2.2.1.0 ... https://www.sophos.com/en-us/support/utm-downloads.aspx

Where could you find 2.2.3.0 ?

Paul Jr

Apologies Sach.. I completely over looked that.. still on 2.2.1.0

Will update today.

Many thanks

i have 2.2.3.0

Did you check the current version in XG? 

Thanks MBP,

Was on 2.2.1.0  so updating now.

Much appreciated..

Where do I get STAS 2.2.3.0?