Live users disappears in few minutes- STAS

Try his one: https://support.sophos.com/support/s/article/KB-000035623?language=en_US Does this WMIC work? 

sorry for being late in reply , But I tried the documentation in link with no success I followed SOPHOS documentation and it was working for about 2 years with no problem but now WMI query only working on DC2 and not working on DC1 , I think the clue is in finding why STAS troubleshooting giving access is denied in WMI verification

That is more likely a Problem in your AD Setup. WMI and the access via WMIC to the client is a windows topic. STAS only uses it. 
You should investigate the microsoft windows logs to get more information. 

That is more likely a Problem in your AD Setup. WMI and the access via WMIC to the client is a windows topic. STAS only uses it. 
You should investigate the microsoft windows logs to get more information. 

that's what SOPHOS support has told me , which logs exactly I should investigate in windows, and who to ask about this problem ???

As I can't find out where is the problem I am thinking in adding additional domain and transfer FSMO roles to it ,then demote the Primary domain controller after checking WMI setting

So: If you do a WMIC.exe to your client and the clients responds "access denied" you have to check the security logs of the client. 

https://learn.microsoft.com/en-us/windows/win32/wmisdk/wmi-troubleshooting