traffic not attributed to user using SATC with Sophos Server Protection

Hello Sophos22,

Thank you for reaching out to the community, please refer the step by step guide for SATC with Sophos Server Protection:
https://community.sophos.com/sophos-xg-firewall/f/recommended-reads/134364/sophos-firewall-satc-with-sophos-server-protection-step-by-step-guide

Thank you. I see, EAP is still necessary.

Is there a release date for this feature? We would like to use it in production.

You're welcome Sophos22 No tentative date announced, but you can use it in production and a you are eligible for Sophos Support with a valid license id in case of any break fix or troubleshooting required...

problem still exists with newer versions. all seems fine, but traffic ist not attributed to user in firewall.

XGS3300 (SFOS 19.0.1 MR-1-Build365)

Core Agent                2022.2.1.9 BETA
Sophos Intercept X        2022.1.2.1 BETA
Server Protection        10.8.11.4 BETA
XDR                        2022.2.1.9 BETA

any ideas or should I open a support case? thanks.

Can you show us your firewall rule, you are using for this terminal server? 

And do you see the users in Live Users? What is in the authentication tab of Logviewer? 

These are a lot of rules. Which settings are important?

Yes, users a listed in live users. But traffic usage is always 0 for these users.

Log viewers says Sucessful. (Thin Client / AD).

_{User xxx@xxx.xxx of group xxxxxxx logged in successfully to Firewall through AD authentication mechanism from x.x.x.x-8}

Do you use any kind of other authentication for this host? STAS or something like that? Is there any logging in of other services as well? 

Do you have a firewall rule for this TS, which uses captive portal? 

No other authentication for this host.

What kind of logging could that be?

No captive portal activated.

There is currently one bug with the case sensitivity of the users.

So if you do a RDP and use IT@sophos.de to login to the Terminal server, the firewall will use it@sophos.com and those accounts are mismatching. Could this potentially be an issue here? 

No. It's all lower case. And problem occurs with all users.