Sophos(STAS) logs out AD users

hello Farzan, 

The reason behind this is actually the WMI timeouts, STAS agent usually checks for user log off detection, using wmi, and if the windows firewall blocks it STAS thinks that there is no user on the workstation and it will delete the user from its DB and there by firewall will loose the authenticated user and then they will be shown a captive portal. to test if WMI is allowed from the STAS server follow this article 

https://community.sophos.com/sophos-xg-firewall/f/recommended-reads/126817/troubleshoot-wmi-connectivity-issue-with-sophos-stas

-Cheers,

Kranthi

Hello Keranthi,

WMI Verification works fine and Windows allows it.

So the question is, when that user is being presented with the captive portal are they still showing up on the STAS server live users ? if yes your STAS is fine and WMI is passing just fine, can you share the screen shots of the STAS  and on the advanced shell ipset -L lusers | grep unauthenticated and see if the userID matches with that off on the live users, if the user ID number is unauthenticated its the WMI 

So the question is, when that user is being presented with the captive portal are they still showing up on the STAS server live users ? if yes your STAS is fine and WMI is passing just fine, can you share the screen shots of the STAS  and on the advanced shell ipset -L lusers | grep unauthenticated and see if the userID matches with that off on the live users, if the user ID number is unauthenticated its the WMI 

Hello, everyone,

I checked WMI connection between STAS and workstation. When I test directly through STAS, it shows that the WMI test is successful. but when I test through WMI tester I get error message.
So that means the user disconnect determined by the Sophos firewall is due to "Logoff Detection". and since "Logoff Detection" runs through WMI, so users are logged off through STAS, because WMI is not working properly.
To temporarily work around the problem, I switched "Logoff Detection" to ping. since then everything works fine and the users are not automatically logged out by STAS. Meanwhile I'm trying to fix the WMI problem.

Thank you