SFOS 16.05.6 MR-6 Broken STAS?

Very strange, STAS is working fine for me on MR6.  I'll be following this thread very closely though. 

Bill Roland said:

Very strange, STAS is working fine for me on MR6.  I'll be following this thread very closely though. 

 

Out of curiosity what OS are your collectors installed on?

I have one on Server 2008 R2 and one on Server 2016

Windows Server 2012R2 for me.

I did have an older version of the STAS Collector on both DC's but updated both to the latest 2.2.1.0 before I rolled back thinking this might be the issue.

Ian Melton said:

I have one on Server 2008 R2 and one on Server 2016

 

and which one is getting hit the most? I have two collectors also but it seems only one gets hit with queries

Yeah mine is similar.

If I open STAS Collector on my Server 2008 R2 box I can only see two live users - The XG reports 162 live users right now.

The server 16 STAS has no live users

Yeah mine is similar.

If I open STAS Collector on my Server 2008 R2 box I can only see two live users - The XG reports 162 live users right now.

The server 16 STAS has no live users

Ian Melton said:

Yeah mine is similar.

If I open STAS Collector on my Server 2008 R2 box I can only see two live users - The XG reports 162 live users right now.

The server 16 STAS has no live users

 

I see lots of errors in the Event Log regarding unable to connect to host to run WMI probes. Since I've altered the security I see less events but at lease the ones that are there are genuine connection refusals. Ive had to add the STAS user account to DCOM group in a GPO to get this thing to stabilise. 

No doubt as a result of MS updates tightening security from ransomware exploits, this has all gone to hell in a hand basket. Ironically STAS auth utilises the same methods the worms use to infiltrate networks.

I see plenty of these:

wrkstpoll_workerthread_wmi: couldnt connected to WMI Namespace '\\192.168.8.94\root\cimv2': 0x800706ba

But users are still getting access via the Proxy so not sure its actually effecting anything.

Not a fan of STAS - I would rather it be like the SG and connect it to AD directly

Ian Melton said:

I see plenty of these:

 

wrkstpoll_workerthread_wmi: couldnt connected to WMI Namespace '\\192.168.8.94\root\cimv2': 0x800706ba

 

But users are still getting access via the Proxy so not sure its actually effecting anything.

Not a fan of STAS - I would rather it be like the SG and connect it to AD directly

 

Doesn't apply in my case. Without STAS, clients auth using NTLM but user based rule sets are applied sparsely. Most not being applied. I had to set up a catch all rule to allow access so effectively security was out the window. With STAS working, rule sets are obeyed.

Hi all,

also in my setup after update from Mr5 to MR6 STAS start to work very bad.

DC is on windows 2008R2

we user WMI polling method, no logoff detection and "0" as dead entry timeout.

All connection test says "ok" but user authentication, after some hour after reboot of sophos xg stop to work.

Le STAS suite was also updated to 2.2.10

Mmmm not good.

Will remain on MR-5 on XG as its stable at present and STAS works