It sounds like the MX may not be talking properly to Active Directory or Active Directory is not confoigured correctly.   Are you seeing these events IDs on your AD controllers?  If not, auditing is not properly enabled in AD.  These are the event IDs the MX monitors for. Using Logon Events (540 and 4624) and Account Logon Events (672 and 4768) https://documentation.meraki.com/MX/Content_Filtering_and_Threat_Protection/Configuring_Active_Directory_with_MX_Security_Appliances#Configuration_Overview    Did you install a on your AD controller?   Check out this troubleshooting guide: https://documentation.meraki.com/General_Administration/Tools_and_Troubleshooting/Active_Directory_Issue_Resolution_Guide      ... View more