Web filtering not picking up user

You need to look for current activities and live users. 

I disconnected all users from Sophos live users and also from the terminal server.

I logged in the to the server as "User1" and browsed the web but User2 popped up in the live users section on the sophos for that server.

Client type is STAS

Any ideas on this LuCar?

STAS? If you have a terminal server, STAS should exclude this terminal server. Essentially the best way is always to have one mechanism per client. So exclude in STAS your terminal servers. 

Excluded terminal server from STAS but still not picking up logged in user

Do you see any AD SSO authentication requests in authentication log? 

I can't see anything at all in the authentication log - it just sits there with the wheel spinning forever and nothing loads

So likely there is no entry? Could the NASM be dead in your scenario? You should check access_server.log and nasm.log if you see any problems there. 

Don't really know what I'm looking at, but here they are

nasm.log:

SFV1C4_AZ01_SFOS 19.0.0 GA-Build317# tail nasm.log                              
Jun 04 13:57:47.107957Z  [ntlmserver]  fasm_processor(): AD channel is UP so inf
orming client now                                                               
Jun 04 13:57:47.107994Z  [ntlmserver]  inform_channel_status(): sumit DATA to pr
oxy='0 0 0 0 0 0 0 0 5 8 0 0 '                                                  
Jun 04 13:57:47.108000Z  [ntlmserver]  inform_channel_status(): informing channe
l status to http proxy, channel status=1                                        
Jun 04 13:57:47.108003Z  [ntlmserver]  fasm_processor(): AD channel is UP so inf
orming client now                                                               
Jun 04 13:57:47.108438Z  [ntlmserver]  inform_channel_status(): sumit DATA to pr
oxy='0 0 0 0 0 0 0 0 5 8 0 0 '                                                  
Jun 04 13:57:47.108450Z  [ntlmserver]  inform_channel_status(): informing channe
l status to http proxy, channel status=1                                        
Jun 04 13:57:47.108454Z  [ntlmserver]  fasm_processor(): AD channel is UP so inf
orming client now                                                               
Jun 04 13:57:47.108488Z  [ntlmserver]  inform_channel_status(): sumit DATA to pr
oxy='0 0 0 0 0 0 0 0 5 8 0 0 '                                                  
Jun 04 13:57:47.108494Z  [ntlmserver]  inform_channel_status(): informing channe
l status to http proxy, channel status=1                                        
Jun 04 13:57:47.108501Z  [ntlmserver]  fasm_processor(): domain informed by nasm
 is 'xxxx'                                          

access_server.log

SFV1C4_AZ01_SFOS 19.0.0 GA-Build317# tail access_server.log                     
MESSAGE   Jun 05 10:09:51.572706Z [CAA]: (CA_keep_alive): Next CA batch in 45 se
conds                                                                           
MESSAGE   Jun 05 10:10:03.115783Z [access_server]: tlvserver_process_request: GO
T ALERT.EXECUTE_HEARTBEAT                                                       
MESSAGE   Jun 05 10:10:36.616862Z [CAA]: (CA_keep_alive): access_server heartbea
t                                                                               
MESSAGE   Jun 05 10:10:36.616883Z [CAA]: (CA_keep_alive): Next CA batch in 45 se
conds                                                                           
MESSAGE   Jun 05 10:11:03.396166Z [access_server]: tlvserver_process_request: GO
T ALERT.EXECUTE_HEARTBEAT                                                       
MESSAGE   Jun 05 10:11:21.660407Z [CAA]: (CA_keep_alive): access_server heartbea
t                                                                               
MESSAGE   Jun 05 10:11:21.660441Z [CAA]: (CA_keep_alive): Next CA batch in 45 se
conds                                                                           
MESSAGE   Jun 05 10:12:03.611785Z [access_server]: tlvserver_process_request: GO
T ALERT.EXECUTE_HEARTBEAT                                                       
MESSAGE   Jun 05 10:12:06.704338Z [CAA]: (CA_keep_alive): access_server heartbea
t                                                                               
MESSAGE   Jun 05 10:12:06.704360Z [CAA]: (CA_keep_alive): Next CA batch in 45 se
conds                                                                 

Check the nasm log for anything, which looks like an error. Basically the nasm should be joining. 

Potentially this could be an error: https://community.sophos.com/sophos-xg-firewall/sfos-v18-early-access-program/f/feedback-and-issues/117669/adsso-ntlm-bug-in-v18-eap3/426421