Stas started, and connection test success, but no user showing in live users/advance

You need to enable windows logon events from secpol.msc or windows security policy on Domain Controller to collect logs and report to stas that users get connected/disconnected. You can find it under secpol.msc>local>audit and select both success and failure from both "logon" type events.

You need to enable windows logon events from secpol.msc or windows security policy on Domain Controller to collect logs and report to stas that users get connected/disconnected. You can find it under secpol.msc>local>audit and select both success and failure from both "logon" type events.

Many thanks Eren.. 

The Sophos Engineer had already enabled that on our DC during the initial install of the XG. 

I can't say "that is the problem" but Server 2003 is not supported on STAS software. And it is the most problematic domain tree in ldap world. I need a deep check of the system. Maybe you can recheck your configuration from https://community.sophos.com/kb/en-us/123156 Sorry

Many thanks Erin,

I have followed that kb article.

And, apologies, we are on a 2012 R2 domain.

Users appearing in STAS 'Show Live Users' is very hit & miss!

Users authenticating against the domain appear in both STAS logs 'View Log' & 'View Logging Events'  but do not appear in 'Show Live Users'.

Therefore they do not appear in 'Live Users' on the XG.

Users then get the Captive Portal to authenticate against when they shouldn't.

To add to this, I've also found the Captive Portal drops out randomly!! Even though 'Preserve captive portal after login' is set to 'no' and 'User inactivity timeout' is set to 'unlimited'.