XG: STAS installed, configured, started but doesnt show live users

Question

Hi all 
 i have an XG firewall (latest firmware), running 5 vlans, single domain controller. 
 i have installed the STAS application on my domain controller, followed the KB to the word 
 https://community.sophos.com/kb/en-us/123156 
 i even changed the user account for the stas app to the domain administrator, i have disabled the firewall on the DC... 
 but, no matter what i do, no live users are showing up in the advanced tab on STAS. 
 
 btw, 
 in the stas agent i have configured all our vlans, all 5 of them 
 in the stas collectors tab i have specified the xg ip address that is on the DC vlan (should i mention all its ip addresses on all vlans?) 
 in the advanced tab - test to sophos ip address is successful! 
 
 i dont understand what is wrong! 
 please help 
 
 maybe screenshots would help a little:

AWP · Answer

Avi Bar Ilan Please make sure on DC you have done, 
 - Go to Start > Administrative Tools > Local Security Policy to view Security Settings. Browse to Security Settings > Local Policies > Audit Policy and double click on Audit account logon events to view the Audit account logon events Properties window. 
 Select both the Success and Failure options and click OK to close the window. 
 - While still in the Local Security Policy , browse to Security Settings > Local Policies > User Rights Assignment and double click on Log on as a service to view the Log on as a service Properties . 
 If the Administrative user being used to install and run STAS is not listed here, select Add User or Group and add the user. Select OK to close the window. 
 - 
 Configure the Windows Firewall and/or 3rd party firewall software to allow communication over the following ports: 
 
 AD Server : Inbound UDP 6677, Outbound UDP 6060, Outbound TCP 135 & 445 (if using Workstation Polling Method WMI or Registry Read Access), Outbound ICMP (if using Logoff Detection Ping), Inbound/Outbound UDP 50001 (collector test), Inbound/Outbound TCP 27015 (config sync). 
 Workstation(s) : Inbound TCP 135 & 445 (if using Workstation Polling Method WMI or Registry Read Access), Inbound ICMP (if using Logoff Detection Ping). 
 
 Note: RPC, RPC locator, DCOM and WMI services should be enabled on workstations for WMI/Registry Read Access. 
 if all above steps are done, check on your domain controller if the event id 4768 is getting logged. To check this in event viewer -> Windows -> security, filter for event id 4768. 
 If no events, try a restart of the DC and check again.