Is anyone else seeing issues with proxy authentication and SMB v1 disabled on servers?

For some insane reason UTM has a dependency on SMB v1 for AD SSO - see Here

I'm not aware of any workaround other than leaving SMB v1 enabled on the DCs, which is frankly unacceptable.

Disable it on your global servers, then create a RO DC and leave it enabled there.  Cuts your risk down some but still allows the functionality needed for UTM.

With all due respect DarrellR, I'm not sure that would work. You need a writeable DC for a device to join the domain.  What I saw was that even on domains that the UTM had previously been joined to, SSO stopped worked as soon as SMBv1 was disabled. It doesn't seem to be a one-time need, but constant communication over SMBv1 to authenticate users.

Depending on exactly what they're doing with their SSO the RODC should just handle (or proxy) the auth requests once the join is sorted but it's still not exactly a great solution if you have a run a special DC just for UTM.

I agree - it's definitely not a good long-term solution, but it is better than leaving your global catalogs hanging in the breeze until Sophos addresses the issue.

But in the SSO config, there's no way to specify which DC to talk to. With multiple DCs, but only one RODC with SMBv1 enabled, wouldn't authentication be hit or miss depending on which DC it decided to contact?

I suppose you could only specify the RODC in the request routing for DNS, but then you would lose any redundancy for internal resolution.

I'm worried that they won't address it. The SMBv1 SSO configuration goes back to the ASG days. Sophos has had years, and multiple versions to fix this. Even the newest release, 9.5, still uses SMB1.

I'm worried that they won't address it. The SMBv1 SSO configuration goes back to the ASG days. Sophos has had years, and multiple versions to fix this. Even the newest release, 9.5, still uses SMB1.