wmic Sophos Firewall Authentication - Win 11 25H2

[Olliedawg]

We use Sophos XGS for our in house filtering, we have always used the STAS client / collector to poll machines via WMI to authenticate users on the firewall when they login to a windows machine. Has worked great for many years.

 

25H2 has finally killed off WMI, so at the moment we are stuck with 24H2 until we can find a different method. Any recommendations? I've seen there is a Registry read option on STAS, I've never tried this though.

[browsw]

If you have Sophos Endpoint then you can use Heartbeat instead to authenticate. We had to make this move when migrating from domain joined to Entra joined as WMI ceased to work.

[Olliedawg]

15 minutes ago, browsw said:

If you have Sophos Endpoint then you can use Heartbeat instead to authenticate. We had to make this move when migrating from domain joined to Entra joined as WMI ceased to work.

Thanks will look into that. We do have endpoint.

[mrbios]

I'm still using STAS with workstation polling method set to WMI and it's working ok right now, i've just tested a Windows 11 25H2 machine (fresh image from MECM).

 

The wmic.exe tool has been removed but the WMI service still works so it should be fine?

[mavhc]

I'm using 25h2 and wmic for STAS, so apparently it works

[Olliedawg]

8 minutes ago, mrbios said:

I'm still using STAS with workstation polling method set to WMI and it's working ok right now, i've just tested a Windows 11 25H2 machine (fresh image from MECM).

 

The wmic.exe tool has been removed but the WMI service still works so it should be fine?

Oh right! To be honest I've not actually tested 25H2 at all yet. We are still a mix of 23H2 / 24H2.

 

Am I getting confused between WMIC and WMI... looks like WMI is still a thing, but WMIC is being disabled by default

Edited November 19, 2025 by Olliedawg

[Adam_Causon]

Good afternoon all,

 

Has anyone even got any documentation on how the alternative "Registry Read Access" Workstation Polling Method works?

 

I have watched a few videos on the STAS Configuration but not been able to find anyone talking about other methods:

 

 

Timestamp: 12:35

 

Thank you in advance!

Adam