Unable to install STAS service ("account name is invalid")

I had the same issue on a DC - I ended up exporting the config from another STAS and then importing it to this instance and loading that and it worked.

Like you no matter what I put it wouldn't accept it.

Thanks. That's what I ended up doing as well. Even with the service installed, I still can't change the user through the STAS gui.  Testing the WMI connection to a workstation, I get "Parameter is incorrect", even though I can successfully query WMI on the workstation through wmic command line. I suspect that the 2 problems are related.

JamesGolden said:

Parameter is incorrect"

Ha yeah that too.

Also trying to sync config from a good STAS to the bad STAS fails as does checking connectivity.

I never did work it out - reinstalling etc did nothing.

And the strangest thing is seeing the service trying to log into workstations with a username of 'mohit". I can't find where that's even coming from. Needless to say it's not working; not finding the users.

I've got a customer I want to roll this and XG out to but they are heavy users of user and group filtering. So this is worrisome.

ERROR [0x1758] 2/12/2020 12:33:37 : wrkstpoll_workerthread_wmi: couldnt connected to WMI Namespace '\\192.168.xx.xxx\root\cimv2': 0x800706ba

DEBUG [0x1758] 2/12/2020 12:33:38 : wrkstpoll_workerthread_wmi: connecting to WMI Namespace '\\192.168.xxx.xxx\root\cimv2'

MSG [0x1758] 2/12/2020 12:33:38 : wrkstpoll_workerthread_wmi: username:.\mohit

What i have noticed is when you try to configure STAS to run under as a service account or use a AD user to logon as a service and publish a GPO, this logon as a service can affect other systems that currently have logon as a service setup locally on their pc's, servers. Sophos advice to run STAS under a domain admin account to logon as a service which most IT admins will not favour. As sophos continue to evolve with new security concepts and address existing issues i am hoping for a better solution.

I followed this guide initially to setup STAS

https://www.fastvue.co/sophos/blog/sophos-stas-authentication-step-by-step/

James,

Did you try to search Sophos in the registry?

Uninstalling stas suite should remove everything.

Did you check if you have something insieme c:\programdata\sophos or something similar?

Take note programdata is hidden by default.

Thanks for the article. Great Post!

I've used STAS with a UTM before. I've just never run into problems installing the stas agent itself.

Just to be certain I uninstalled and went through the registry, program files, and programdata again.  I manually deleted a few entries from the registry, but it did a good job of cleaning up after itself everywhere else. Tried reinstalling, but hit the same roadblock when specifying a user account to use for the service to log in with.

And now, after going through the reinstall, importing the service back into the registry, since it won't install the service during the install, the stas agent and collector test won't even pass. 

I'm considering rebuilding the DC, but I really hate to have to go through that.

I recall I managed to sign in with my domain\administer account and get it loaded - then changed it to my domain/stas account.

Have you tried that?

James,

If it does not work, open a ticket with the support. Rebuilding a dc is always a pain.

Regards