WMI BLOCKED / STAS

Question

Dear colleagues!

We are having problems connecting via STAS on newer versions of Windows. In Sophos Transparent Authentication Suite in WMI VERIFICATION, the workstation shows access denied. We even used the key below but it doesn't work anymore.

Path : HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\AppCompat

Value Name: "RequireIntegrityActivationAuthenticationLevel"

Type: dword

Would you have any solution for this problem?

Erick Jan · Answer

Hi Bruno, 
 Thank you for reaching out to Sophos Community. 
 Have you tried to follow any KB? Kindly check the following 
 
 https://community.sophos.com/sophos-xg-firewall/f/recommended-reads/126817/troubleshoot-wmi-connectivity-issue-with-sophos-stas#mcetoc_1gglu0qj24 
 https://support.sophos.com/support/s/article/KB-000035623?language=en_US&name=KB-000035623 
 https://learn.microsoft.com/en-us/windows/win32/wmisdk/connecting-to-wmi-remotely-starting-with-vista 
 Is the local Firewall Enabled for the Workstations 
 Add an exception for TCP ports 445 and 135 
 Are the services running on the affected workstations 
 Restart the services 
 Confirm the following on the Workstations
 
 Inbound TCP 135 & 445 (if using Workstation Polling Method WMI or Registry Read Access), 
 Inbound ICMP (if using Logoff Detection Ping). 
 RPC, RPC locator, DCOM and WMI services should be enabled on workstations for WMI/Registry Read Access+ 
 netlogon

kindly share screenshots from the log viewer 
 logs from the host where the STAS suite has been installed
 
 C:\Program Files (x86)\Sophos\Sophos Transparent Authentication Suite\stas.log

You may also check this older post 
 
 WMI Verification "A ccess is Denied" while configuring STAS

WMI BLOCKED / STAS

Top Replies