Thread Info
  • State Suggested Answer
  • Locked Locked
  • Replies 10 replies
  • Answers 1 answer
  • Subscribers 29 subscribers
  • Views 22312 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Enabling "logoff detection", The firewall disconnect users after some minutes

Herberth Alves

I have problem with STAS.

When I enable the option "Logoff Detection" (follow this article: community.sophos.com/.../123020) in a few minutes all users are disconnected from firewall ("current users"). It is just possible to reconnect after each user make a logoff in the windows and log in.



This thread was automatically locked due to age.
Parents
  • 0

    Hi Herberth,

    That means the WMI query is failing. Start STAS and perform a WMI\Registry read access verification to user’s IP address. If query is failed, follow the steps:

    • Windows firewall or Antivirus could block WMI\Registry read access query. Add exception for TCP port 445 and 135 in client machine.
    • Make sure that RPC, RPC locator, DCOM, WMI services are enabled in the system.
    • Client machine should resolve AD FQDN, if not add host entry into machine or use AD IP as primary DNS.
    • If there is any router/firewall in between, make sure that port 135 and 445 is open.
    • Ensure that administrator account used in STAS is having administrator rights on client system.

    Any help? Also, what is the firmware version of XG.

    Sachin Gurung
    Team Lead | Sophos Technical Support
    Knowledge Base  |  @SophosSupport  |  Video tutorials
    Remember to like a post.  If a post (on a question thread) solves your question use the 'This helped me' link.

  • 0 in reply to sachingurung

    Hi  Thank you.

    But my tests are all OK. 

     

    • Windows firewall or Antivirus could block WMI\Registry read access query. Add exception for TCP port 445 and 135 in client machine.

    OK

    • Make sure that RPC, RPC locator, DCOM, WMI services are enabled in the system.

    OK

    • Client machine should resolve AD FQDN, if not add host entry into machine or use AD IP as primary DNS.

    OK

    • If there is any router/firewall in between, make sure that port 135 and 445 is open.

    OK

    • Ensure that administrator account used in STAS is having administrator rights on client system.

    OK

  • 0 in reply to Herberth Alves

    Then is it something to do with the firmware version as reported in other threads? What is the firmware version?

    Thanks

    Sachin Gurung
    Team Lead | Sophos Technical Support
    Knowledge Base  |  @SophosSupport  |  Video tutorials
    Remember to like a post.  If a post (on a question thread) solves your question use the 'This helped me' link.

  • 0 in reply to sachingurung

    Hello!!!

    We are using SFOS 16.05.4 MR-4 

  • 0 in reply to Herberth Alves

    Show me a picture of the log off detection tab in the STAS and from Authentication | Services | Global settings and Web Client.

    Thanks

    Sachin Gurung
    Team Lead | Sophos Technical Support
    Knowledge Base  |  @SophosSupport  |  Video tutorials
    Remember to like a post.  If a post (on a question thread) solves your question use the 'This helped me' link.

  • 0 in reply to Herberth Alves
    Try this, in STAS under "STAS Collector Tab" where the XG IP "192.168.1.252" is added, instead of that please add IP as "192.168.1.0 & subnet as 255.255.255.0 (/24)". Any Help?

    Sachin Gurung
    Team Lead | Sophos Technical Support
    Knowledge Base  |  @SophosSupport  |  Video tutorials
    Remember to like a post.  If a post (on a question thread) solves your question use the 'This helped me' link.

  • 0 in reply to sachingurung

    Hi !

    When you testing WMI connection via Sophos STAS or WMIC the workstations respond ? If no and like you said applied WMI exception in Windows Firewall. I already catched one of these problems, and when i dump packets of the wmi communication with wireshark, i receive AP_ERR_KERBEROS, it's because there are a problem with security communication besides workstation and Domain Controller, after take off and put in workstation again in domain the problem was solved. WMI communication happened

Reply
  • 0 in reply to sachingurung

    Hi !

    When you testing WMI connection via Sophos STAS or WMIC the workstations respond ? If no and like you said applied WMI exception in Windows Firewall. I already catched one of these problems, and when i dump packets of the wmi communication with wireshark, i receive AP_ERR_KERBEROS, it's because there are a problem with security communication besides workstation and Domain Controller, after take off and put in workstation again in domain the problem was solved. WMI communication happened

Children
Cookie Information Banner