XGS 136w - How to setup up STAS and/or SATC for WIndows Remote Desktop?

Hello Iain Penman,

Thank you reaching out to the community, we would recommend once you to refer the guide for SATC here:  https://community.sophos.com/sophos-xg-firewall/f/recommended-reads/134364/sophos-firewall-satc-with-sophos-server-protection-step-by-step-guide and for the STAS: https://community.sophos.com/sophos-xg-firewall/f/recommended-reads/125318/sophos-firewall-best-practice-for-stas
for the configurations part, if you have any troubles after the configuration, please feel to revert here !!

SATC + the registry keys from the Article Vivek wrote + new "Citrix" Server IP on the Shell should do the trick. Should work with SATC client and intercept-X also, but I have not tested this.

https://docs.sophos.com/nsg/sophos-firewall/18.5/Help/en-us/webhelp/onlinehelp/AdministratorHelp/Authentication/SophosAuthenticationForThinClient/SATC/AuthenticationSetupSATCUsingEndpointProtection/index.html#set-up-satc-on-a-windows-server-through-the-registry

That was exactly what I was looking for - thanks.

The process seems very involved for the simple outcome I wanted - but it works, thin-client logins are now listing on the XGS.

However - now I'm NOT seeing normal STAS logins coming up, even though the STAS collector and agent sem to be working fine.

I have excluded the RDP server from the STAS processing.

Is there something about enabling the thin client SATC with Server Protection that kills the normal STAS process?

you should not install SATC with Intercept-X. I-X does the Authentication when it is installed.

You need the SATC client only when no or other AV is onstalled. I think SATC is priorized against STAS but that may not be true.