This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

STAS doesn't register logins from most clients

Hello everyone,

I have serious issues with deploying STAS in a customers environment. I have installed the STAS agent in several environments according to KB123156 and haven't had any problems yet but on this system something seems to be wrong...

 

When viewing the live users in the STAS agent, there are just a few and not as much as I would expect. While testing we discovered, that it doesn't matter which user is logging in but on which system. We chose ten users and ten systems and tried logging in with every user on every system. After all was done, we discovered that 8/10 systems didn't show up in the live users with any user and 2/10 showed up with every user. I compared the AD objects but couldn't see any noticable difference between the systems that worked and those that didn't.

Note: There was only one DC present, so all logins were handled there. All of the logins worked on the respective systems. The difference is in showing up in the live users. All systems are provided IPs via DHCP.

 

Next we looked at the logging events via the button on the advanced tab. All logins were present but different. The systems with correct logging showed up like this:

MSG   [0x898] 25.08.2017 11:00:50 : init_userinfo_kerberos: IPv6 WorkstationIP: :

MSG   [0x898] 25.08.2017 11:00:50 : init_userinfo_kerberos: IPv4 WorkstationIP: 192.1.1.69

 

The systems that didn't log correctly showed up differently:

MSG   [0x898] 25.08.2017 11:01:42 : init_userinfo_kerberos: IPv6 WorkstationIP: 2

MSG   [0x898] 25.08.2017 11:01:42 : init_userinfo_kerberos: IPv4 WorkstationIP: 196

 

When changing the IP to static, everything stays the same. When changing the IP, the value "196" changes to something else. 196 is actually the last segment of the IP plus 256 converted to hex... If the IP is x.x.x.150 it says "196", if it's x.x.x.161 it says 1a1 and 1c8 for x.x.x.200.

I don't know if this is a problem with STAS or Active Directory, but maybe someone has seen something like this before.

Thank you

Björn



This thread was automatically locked due to age.
Parents
  • I'd be curious to disable ipv6 and see what happens. I'm just a newbie to Sophos though so take my advice as a grain of salt.

  • Thank you for your input, Greg. Unfortunately that didn't work either.

    We disabled IPv6 in the Windows network settings but the error seems to stay consistent.

     

    But I noticed one more thing: One of our test subject is a virtual Windows 7 client on Hyper-V. We logged in and got the said error - the IP wasn't logged properly. Then we shut the machine down and transferred it to another Hyper-V server. Booted, logged in... success... the same client got it wrong while on one Hyper-V server and got it right on the other one... and we still don't know why...

     

    Sophos Support hasn't even contacted me yet... three weeks after I created a ticked...

Reply
  • Thank you for your input, Greg. Unfortunately that didn't work either.

    We disabled IPv6 in the Windows network settings but the error seems to stay consistent.

     

    But I noticed one more thing: One of our test subject is a virtual Windows 7 client on Hyper-V. We logged in and got the said error - the IP wasn't logged properly. Then we shut the machine down and transferred it to another Hyper-V server. Booted, logged in... success... the same client got it wrong while on one Hyper-V server and got it right on the other one... and we still don't know why...

     

    Sophos Support hasn't even contacted me yet... three weeks after I created a ticked...

Children
No Data