Can't find AD user in Report

Hi Iftikhar,

Welcome to Sophos Community.

What authentication method are you using on the XG? Where in the reports section are you looking for AD users? Please provide us some details so that we can understand your question.

Thanks

Thanks for reply.

We use AD authentication for SSL VPN user.

All network rule are base on IP address.

I tried to create user base rule with AD group and any user but it does not work.

I simply add AD server and have not install any sophos tool on AD.

Do i have to install any tool like SSO?

Report

when I see user report, it shows unidentified user.

I want to see user report in details on bases of AD user ID. 

Ahmed,

in order to get Report by users, Firewall has to associate Users to IP (Always).

Make sure to follow the guide below and to follow all the links inside the guide:

https://community.sophos.com/kb/en-us/123155

Once your XG recognizes the "users" you will get Reports by Users.

Regards

Hi Iftikhar,

After successfully configuring AD with Sophos XG, you need to authenticate User to pass them through the User Network rule. Once that is in order, the reports shall reflect username. The easiest is to configure captive portal authentication which redirects all the unauthenticated traffic to a login pop-up. 

Thanks

Thanks for reply.

AD server is configured.

User rule is working on a user(domain admin) and it doesn't work on AD groups or other user.

When I enable captive portal then XG firewall drop my teamviewer session( internet stopped).

Any suggestion?

Thanks

Ahmed,

if your AD users are not correctly authenticated, your STAS and XG are not communicating correctly.

On STAS, live users, do you see users disconnecting and connecting on computer?

Thanks

I can see liver user on STAS but user is not authenticate automatically.

I enabled captive portal and every time STAS failed and captive portal ask username and password on client PC.

When I disable captive portal then sophos user rule was not hit.

Anyone have any idea?

I think you enabled auditng under Defaul Domain Controller Policy and not Default Domain Policy.

Can you share the domain policy > Auditing?

Also make sure on your Domain Controller > Event Viewer > Security Event you see users that log-in and log-out event on computer.

You should see event id 4624 like:

https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4624

Thanks