Change Sophos Heartbeat-Userdomain?

bmu 2 months ago

Hi there,

we've client with Sophos Intercept X installed and figuring the Heartbeat-Feature within our Sophos XG 135 out.

My "problem" is, that our Windows Clients are recognized as "username@domain.tld", if i view the "Current activities" in the Sophos XG WebGUI.
We sync our users from Microsoft AD to the Sophos - with our internal domain name "username@intern.domain.local"; this Users has also attached a MFA and used to connect by SSLVPN.

Because of the heartbeat, the Sophos XG created ~120 new Sophos useraccounts with @domain.tld - i would like to merge or delete them, so that the reports and so on are correct.

Is it possible to change the Domainname, that Sophos Intercept X is sending to Sophos Central? If i could change that to @intern.domain.local, the existing users would be matched.

Thanks in advance,

Bastian

Added tags
[edited by: Gladys at 3:27 PM (GMT -8) on 4 Mar 2024]

Parents

0 LuCar Toni 2 months ago

Likely this is not possible.
Because your Endpoint is extracting your tld top level domain. And therefore this is send to the firewall for authentication.

__________________________________________________________________________________________________________________
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 bmu 2 months ago in reply to LuCar Toni

Hi,

okay, so my only solution would be: Change intern.domain.local to domain.tld in my Sophos AD-Authentication Servers and manually change all MFAs from the old username@intern.domain.local to username@domain.tld (or: let all users create a new MFA with their new user)?
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 LuCar Toni 2 months ago in reply to bmu

You could change it around: You could add the .tld domain to the other AD server, then the old users with the local domain would be matched with the tld user.

That could mean, the certificates of VPN etc. could be invalid.

__________________________________________________________________________________________________________________
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

Reply

0 LuCar Toni 2 months ago in reply to bmu

You could change it around: You could add the .tld domain to the other AD server, then the old users with the local domain would be matched with the tld user.

That could mean, the certificates of VPN etc. could be invalid.

__________________________________________________________________________________________________________________
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

Children

No Data