AD Security Groups Not Populating

Navar,

importing all Domain users is not a best practice. You should import only certain groups and create Firewall Rules on those groups. Try this test to make sure that AD integration works:

Once the group is imported, create a policy rule where only the imported group can surf on internet and check under authentication log if a user matching that rule is correctly authenticated.

Also on the Control Center you should see Live users counter increased.

Thanks

Navar,

importing all Domain users is not a best practice. You should import only certain groups and create Firewall Rules on those groups. Try this test to make sure that AD integration works:

Once the group is imported, create a policy rule where only the imported group can surf on internet and check under authentication log if a user matching that rule is correctly authenticated.

Also on the Control Center you should see Live users counter increased.

Thanks

I know domain users is not the best thing to do but we wanted to get XG Web filtering going.

But we are have a bunch of STAS sync issues.  We have a security that has 25 users in it but only 17 show up.  The 8 other don't get the test policy/rule.

I have created a security group and added my test account.

But this test account was in another security that we already have in XG.  I have removed my test account but it still shows in the group when checking members in XG.

How do I force a re-sync?

Navar,

XG uses Tight integration , where the Username is fetched from the AD along  with its Group association, So if you have imported the Group from AD then it would be assigned to that Group only but Group association must be set primarily on AD server.  Unless the Group is not imported then it would set to Open Group by default .  Also if you create a Group on XG itself and manage to assign a user to be a member of the Group then also it would revert back after an authentication attempt. 

See this thread!

Hope it is clear.

It is looking more and more like STAS is the issue.

I just checked the 4 DCs and the agents has stopped on all of them.

Here is what support recommended.

Put agent and collector on DC01 and DC02.  Then for DC01 under STA Agent add DC02 to the collector list.  Then for DC02 under STA Agent add DC01 to the collector list.

Then for DC03 and DC04 added both DC01 and DC02 to their collector list.

We did have to stop using WMI for Workstation Polling and go with Registry Read Access because WMI was generating a ton of DCOM errors in the DC event log.

I have also noticed that the XG box keeps disappearing from under the General tab "Sophos Appliances"

Navar,

Make sure that all the firewall ports are opened:

And all the steps needed are configured.

Can you also share a dcom error you seee from events?

Thanks

We have 4 DCs.  Two run both collector and agent and two just run agents.

Agent on the two run both functions keeps stopping.

How depended is STAS on DNS?