STAS ISSUE !!!

i have face same issue stiil any one having solution please help

isuue-After user login with AD credential user get internet .so i have created with  multiple user based policy but after 15 to 20 min its changed to network policy so please help.

Hi satyabrata bastia 

May I know the number of users affected facing the same issue?

Regards

Hi,

all user having same issue.

 Hi satyabrata bastia 

Suspecting issue from between your DC and System level 

Please follow the link shared by Vivek Jagad  and try to make sure settings are as per the document as well as check the logs as guided 

Please share all the findings with a snapshot along with the current setting/configuration applied on Sophos XG and DC.

Thanks and regards 

 Hi satyabrata bastia 

Suspecting issue from between your DC and System level 

Please follow the link shared by Vivek Jagad  and try to make sure settings are as per the document as well as check the logs as guided 

Please share all the findings with a snapshot along with the current setting/configuration applied on Sophos XG and DC.

Thanks and regards 

i have checked with sophos wmi pooling method using one ip address its showing access denied.so we need to configure wmi or ping method .

Hi  satyabrata bastia 

Yes, it is a Windows System level issue, how many windows systems you have faced the same access denied message while testing from STAS suite?

The fix is provided by Microsoft as per the below link try and share the result.

https://support.microsoft.com/en-us/topic/kb5004442-manage-changes-for-windows-dcom-server-security-feature-bypass-cve-2021-26414-f1400b52-c141-43d2-941e-37ed901c769c 

Contact Microsoft support as well to solve the issue with wmi or ping polling method if above link not useful.

Thanks and Regards

we have 250 user and i have with ip in wmi its denied

Can you try with one or two windows system for a test as per the below link and share the result ?

https://support.microsoft.com/en-us/topic/kb5004442-manage-changes-for-windows-dcom-server-security-feature-bypass-cve-2021-26414-f1400b52-c141-43d2-941e-37ed901c769c 

Regards

sir i have check with sophos document for wmi polling method need to configure windows gpo,logon and logoff detection should be enable and inbound wmi connection should be enable .so please tell me which one i will follow to resolve or ping method should be enable

satyabrata bastia said:

sophos document for wmi polling method

Yes you have already found the issue with help Sophos Document where wmi is getting failed from Windows System now you have to fix the issue from your Windows Systems as per the shared link.

Regards

sir can i share windows issue document i found when i checked with sophos stas document .

i have collected all details with screen shot if you conform then i will send you

That might not help sharing Microsoft documents to Sophos as it is windows version related issue as of now you can share snapshot that shows the AD is getting successfully integrated message and the current STAS setting applied on Sophos XG as per the link:

AD integration:https://docs.sophos.com/nsg/sophos-firewall/17.5/Help/en-us/webhelp/onlinehelp/nsg/sfos/tasks/AddActiveDirectoryServer.html 

STAS settings https://docs.sophos.com/nsg/sophos-firewall/17.5/Help/en-us/webhelp/onlinehelp/nsg/sfos/learningContents/ConfiguringTransparentAuthenticationSTAS.html to check configuration is proper.

Login to console with SSH go to option 4 and run tcpdump 'port 6060 or 6677 

share the output of tcpdump too

Your issue will get fixed if you check with the Windows version as you have shared no detail on which Windows Version you are facing the issue  and by contacting Microsft support 

Try to update the windows system.

Follow this link too https://support.sophos.com/support/s/article/KB-000035623?language=en_US 

Regards

how to run tcp dump

Login to console with SSH go to option 4 and run tcpdump 'port 6060 or 6677