This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

STAS doesn't register logins from most clients

Hello everyone,

I have serious issues with deploying STAS in a customers environment. I have installed the STAS agent in several environments according to KB123156 and haven't had any problems yet but on this system something seems to be wrong...

 

When viewing the live users in the STAS agent, there are just a few and not as much as I would expect. While testing we discovered, that it doesn't matter which user is logging in but on which system. We chose ten users and ten systems and tried logging in with every user on every system. After all was done, we discovered that 8/10 systems didn't show up in the live users with any user and 2/10 showed up with every user. I compared the AD objects but couldn't see any noticable difference between the systems that worked and those that didn't.

Note: There was only one DC present, so all logins were handled there. All of the logins worked on the respective systems. The difference is in showing up in the live users. All systems are provided IPs via DHCP.

 

Next we looked at the logging events via the button on the advanced tab. All logins were present but different. The systems with correct logging showed up like this:

MSG   [0x898] 25.08.2017 11:00:50 : init_userinfo_kerberos: IPv6 WorkstationIP: :

MSG   [0x898] 25.08.2017 11:00:50 : init_userinfo_kerberos: IPv4 WorkstationIP: 192.1.1.69

 

The systems that didn't log correctly showed up differently:

MSG   [0x898] 25.08.2017 11:01:42 : init_userinfo_kerberos: IPv6 WorkstationIP: 2

MSG   [0x898] 25.08.2017 11:01:42 : init_userinfo_kerberos: IPv4 WorkstationIP: 196

 

When changing the IP to static, everything stays the same. When changing the IP, the value "196" changes to something else. 196 is actually the last segment of the IP plus 256 converted to hex... If the IP is x.x.x.150 it says "196", if it's x.x.x.161 it says 1a1 and 1c8 for x.x.x.200.

I don't know if this is a problem with STAS or Active Directory, but maybe someone has seen something like this before.

Thank you

Björn



This thread was automatically locked due to age.
Parents
  • I'd be curious to disable ipv6 and see what happens. I'm just a newbie to Sophos though so take my advice as a grain of salt.

  • Nearly a year later and we finally solved this mystery...
    For some reason, nobody is able to explain, the customers DC switched between IPv4 and IPv6 in the logs. Sometimes clients would show up with an IPv4 and sometimes with an IPv6. When they registered with IPv6, the STAS wasn't able to process the IP.

    There are two thing I just can't wrp my head around.

    1. We disabled IPv6 on our test clients and it had no effect and they aren't provided with any IPv6 addresses... once we disabled IPv6 on the DCs everything went smoothly...
    2. Why are there fields for IPv4 and IPv6 in the log of the STAS when the tool is not able to process IPv6?

    So... if you run onto this problem... disable IPv6 on your DC

Reply
  • Nearly a year later and we finally solved this mystery...
    For some reason, nobody is able to explain, the customers DC switched between IPv4 and IPv6 in the logs. Sometimes clients would show up with an IPv4 and sometimes with an IPv6. When they registered with IPv6, the STAS wasn't able to process the IP.

    There are two thing I just can't wrp my head around.

    1. We disabled IPv6 on our test clients and it had no effect and they aren't provided with any IPv6 addresses... once we disabled IPv6 on the DCs everything went smoothly...
    2. Why are there fields for IPv4 and IPv6 in the log of the STAS when the tool is not able to process IPv6?

    So... if you run onto this problem... disable IPv6 on your DC

Children