SATC - Mostly Not Working

Thanks for the suggestion Sachin. I've been exhaustively through the Forums and KB and unfortunately, you wont find anything in them that I have not already seen/used.

Since my company is a Sophos reseller, I'm going to open a ticket with Sophos Support when I get some time to dedicate to this once again. I'll contribute back to this Forum once I get a resolution.

Regards,

Gary

Hi Gary,

Provide me the case# so that I can take a look into it. 

Thanks

Hello Gary,

I had exactly the same problem, and "the problem" is that you are using Windows Server 2012 R2. This version of Windows Server as a basic form of authentication uses the Kerberos protocol. All previous versions of Windows Server as the basic form for authentication using NTLM protocol.

The fix for this problem is very simple, please see to this link https://community.sophos.com/products/xg-firewall/f/authentication/83357/stas-problem-with-user-authentication-on-xg-v16 . I added my comment with the screen from the Group Policy Management Editor. This configuration for the Kerberos protocol auditing solved these problems.

Do this configuration, and the problem it solves.

alda

P.S. Please write here if this configuration really helped to you. I asked Sophos to add this configuration to the KB, but until now they did not add this into the KB!

Hi Alda,

Thanks for the response and the suggestion.

Before I start making further changes to the security GPO's on my domain can you once  confirm that the problem you were having was with SATC rather than STAS?

Part of what is described in the link you mentioned was done when STAS was configured. Specifically, within the Default Domain Controllers Policy. However, that particular policy remains un-configured for the Default Domain Policy. My STAS implementation is working just fine.

Since the SATC is installed on a non-production Terminal Services server, I edited the local policy such that Logon/Logoff Audit for Success/Failure are now configured. It made no difference to my problem.

Gary

Here you go!

22357282

Thanks!

Hello Gary,

the configuration for the Kerberos protocol ( or Advanced Audit Policy Configuration  by Microsoft tongue ) that I did  ( and that I still use in our MS Active Directory domain ) is important for the STAS but for the SATC too. If you have in your MS Active Directory domain at least one Windows Server 2012 R2 or Windows Server 2016 you have to configure the Advanced Audit Policy Configuration ( or Kerberos protocol auditing ).  

The STAS is needed for authorization all users who work directly on any desktop or notebook, directly at their console. But for any other users connected to a MS Terminal Server or any users connected by RDS protocol to any desktop you have to use the SATC authetnication agent. What is according to your description and configuration your case too, I think.

In online manual for XG Single Sign-On clients you could read:

Sophos Authentication for Thin Client (STAC) - Enables transparent authentication for users in Citrix or Terminal Services Environment whereby network credentials can be used to authenticate and the user has to login only once to access network resources.

By this is meant a Windows Terminal Server or any connection to any desktop by RDS protocol. And, of course, you have to install into any Terminal Server client environment ( or any desktop with RDS access ) the Sophos Authentication For Thin Client (SATC) from XG Single Sign-On menu. 

What is also equally important, is the activation of this configuration by command " gpupdate / force " on all domain controllers. 

alda

Hi Alda,

Thanks for all your efforts. However, this hasn't changed the behavior of SATC in any way.

I've made the changes as suggested to the relevant GPO's on both of my DC's. Did 'gpupdate /force' on both DC's plus on the TS that I'm working on. I've even rebooted the TS just to be sure.

The only thing I haven't done is to uninstall SATC then reinstall it. I'll try that later this day.

Hi Gary,

The case# do not exists.

Thanks

Sorry Sachin, that was the Activity ID that I sent you.

Support ticket # is 7019323

I've uninstalled then re-installed SATC.

No change to behavior. SATC is not able to enumerate logon/logoff incidents. If the logs are to be believed, it never sees a logon or logoff.