Why do Domain-Users fall into Open Group?

Question

Hi! 
 I have STAS running and it works quite well for my "Domain-Admin" user. But now I've created a new AD user who belongs to the group "Domain-Users". Unfortunately, this user always gets mapped to "Open Group" instead of the correct group ("Domain-Users"). 
 STAS shows that this particular user is logged in using "Logon Type 2" and XG's log writes that the "user XYZ of group Open Group successfully logged in successfully to Firewall through AD authentication". 
 If I manually add this user to the correct group everything's fine until the user logs out. 
 Is there anything I'm missing?

sachingurung · Accepted Answer

Hi, 
 Greetings. 
 By default, users in Active Directory are all part of the Security Group 'Domain Users'. This global security group is automatically set as the primary group in the Member Of settings for the user. The 'memberof' attribute of the user object is not populated with the group name. Because the XG does not query Active Directory for the PrimaryGroupID attribute, and only for the Members attribute of the group, users cannot be prefetched. 
 To resolve this issue, create another global Security Group, such as 'XG Domain Users', and add all users from 'Domain Users'. 
 Hope that helps. 
 Thanks

sachingurung · Answer

Hi, 
 Group information are forwarded from AD to STAS agent, Agent pass on username, user IP, user group information to Collector. Sophos firewall sends a user map request (Full update/Incremental update) on UDP port 6677 to Collector and sync it's user map with Collector. The reason why User(s) are falling into the Open group is due to some configuration mismatch in AD. Again, by default Primary group information will not be forwarded from AD. 
 Thanks

oxident · Answer

Thanks for clarification. I've double checked all those information and after all, the problem had something to do with special characters in the group name. 
 I've now created a group with any "umlauts" (&auml;&ouml;&uuml;&szlig;), imported it within XG and everything works flawlessly. 
 Anyway, thanks for all of your hints!

OLUGBEBGA OLETUBO · Answer

Also you need to check your firwall authentication methods and check the default group you set for Sophos. This groupd is the group that Sophos automatically adds your imported groups to