Dell SonicWall Single Sign On (SSO) agent often pulls service user accounts (Sophos Antivirus, Nvidia Updater, etc.) instead of actual logged in users. I noticed that this is especially prominent when DC Security Logs option is used.

In this example SonicWall SSO agent is pulling sophos.update account instead of actual logged-in domain users.

To resolve the issue login to SonicWall firewall and navigate to Users > Settings. Click on Configure SSO button, then change to Users tab and add “sophos.update” and other system / service accounts you want to exclude to “User names used by Windows services” list.

SonicWall tutorial didn’t mention this, but for changes to take affect I had to restart SSO Agent service using Directory Connector Configuration.

April 2017
SonicWall NSA 220W