STAS issues with RDP

Question

We use a lot of single user RDP sessions so I've configured STAS with Registry Read polling and it works except for two issues: 
 - When the polling happens every three minutes, the live users for the RDP sessions drop out for up to 10 seconds. 
 - If I connect to a remote session as a different user, then the live user for my local system changes to the other user too until the next polling happens when it reverts. I've seen another post about this but it just mentions 'Per Connection Authentication', but that isn't relevant to STAS. 
 I'm using authentication on firewall rules so both issues have the potential to cause annoying glitches for users. 
 Any help getting this over the line would be much appreciated.

Vishal_R · Answer

Hi jtaylor Thank you for reaching out to the Sophos community team, for the 1st one you may tweak the "Identity probe time-out" and "Restrict client traffic during identity probe" settings as per the below RR guidance.

Sophos Firewall: Best practice for STAS
Sophos Firewall: Best practice for STAS

Ideally, RDP logins with STAS are not supported as mentioned in the below KBA, and may create a problem you mentioned.
https://support.sophos.com/support/s/article/KBA-000006347?language=en_US

Taking the RDP of the machine with different users will create an issue with STAS and replace the existing user as per STAS working. So better to exclude any such username in the STAS login exclusions which may help to some extent.

STAS issues with RDP

Top Replies