Technical Tip: FortiGate FSSO - User Identification vs. Machine Accounts (HOSTNAME$)

Description

This article describes the conditions under which FortiGate displays machine accounts in the format DOMAIN\HOSTNAME$ in traffic logs and user identity reports, instead of the authenticated human user name. Root cause analysis, occurrence scenarios, and available remediation methods are covered.

Scope

• FortiGate with FSSO enabled (Collector Agent or agentless mode);

• Active Directory environments with domain-joined Windows workstations;

• All FortiOS versions using FSSO polling of Windows Security Event Logs

Solution

Root cause - Kerberos Machine Logon.

Upon system startup or resume from hibernation, a Windows workstation performs a Kerberos Machine Logon before any interactive user session is established. This event generates an authentication record in the Domain Controller Security Event Log under the account name format DOMAIN\HOSTNAME$. The FSSO Collector Agent captures this event and reports to FortiGate that the workstation IP address is associated with the machine account - not with a human user.

Note: The $ suffix identifies machine accounts in Active Directory. These accounts are created automatically when a computer joins the domain and are used by the operating system for Kerberos authentication.

Event flow that produces the issue:

Note: Between Machine Logon and User Logon, FortiGate identifies workstation traffic as HOSTNAME$.

Scenarios where the issue persists:

In the following scenarios, the HOSTNAME$ mapping remains associated with the IP address even after the user logon event:

Diagnostics - verifying active FSSO mappings:

The following CLI commands allow inspection of active IP-to-user mappings on FortiGate:

List all users authenticated via FSSO:

diagnose debug authd fsso list

Filter results for a specific IP address:

diagnose debug authd fsso list | grep 192.168.1.50

Monitor FSSO updates in real time:

diagnose debug authd fsso server-status

Display FSSO groups received from the Collector Agent:

diagnose debug authd fsso refresh-user

Example output indicating a machine account in the active mapping:

IP: 192.168.1.50  User: CORP\WKS-FINANCE01$  Groups: [Domain Computers]
IP: 192.168.1.51  User: CORP\john.doe         Groups: [VPN-Users, Domain Users]

• Entry with $ suffix = machine account (issue condition).

• Entry without $ suffix = human user (expected condition).

Remediation methods:

Add machine accounts to the Ignore User list in the FSSO Collector Agent (recommended):

The FSSO Collector Agent does not provide a dedicated toggle to suppress machine account events. The correct approach is to add machine account name patterns to the Ignore User List using wildcards. Entries on this list are discarded by the Collector Agent before any logon event is forwarded to FortiGate.

Note: Entries added to the Ignore User List on the Collector Agent are automatically synchronized to all monitored DC Agents. This reduces both the volume of network traffic between DC Agents and the Collector Agent, and the number of logon events that DC Agents must process.

Procedure - Collector Agent console:

• From the Windows Start menu, navigate to Programs -> Fortinet -> Fortinet Single Sign On Agent and open the Collector Agent console.

• In the Common Tasks section, select Set Ignore User List. The current ignore list is displayed.

• Select Add. In the username field, enter the following wildcard patterns to match all machine accounts: 

Notes:

• Pattern 1 — matches any account ending with $ (standard machine account format)

*$

• Pattern 2 — domain-prefixed variant (if domain prefix is shown in logs):

DOMAIN\*$

Wildcard reference:

• * matches any number of variable characters

• ? matches exactly one variable character

Example: WKS-FINANCE01$ is matched by *$

Example 2: CORP\WKS-FINANCE01$ is matched by DOMAIN\*$

• Select Add to confirm each entry, then select OK. The Collector Agent may restart; existing authenticated user mappings are preserved during the restart.

Warning: Adding $ to the Ignore User List suppresses ALL accounts ending with the $ suffix. In non-standard environments where legitimate user accounts include a $ in the name, a more specific pattern such as 'DOMAIN\WKS-$' must be used to avoid unintended exclusions.

Reduce the FSSO authentication timeout:

Reducing the session timeout causes the machine account mapping to expire quickly. The subsequent user logon event then overwrites the stale entry.

config user fsso
    edit "FSSO_Collector"
        set server          "<collector-agent-ip>"
        set password        <password>
        set port            8000
        set source-ip       <fortigate-ip>
    next
end

Adjust authentication timeout (default: 480 minutes).

config user setting
    set auth-timeout      30
    set auth-timeout-type idle-timeout
end

Agentless Mode - Direct DC polling.

In agentless mode, FortiGate reads Security Event Logs directly from the Domain Controller. The configuration below applies basic polling parameters:

config user fsso-polling
    edit "DC-POLLING"
        set server            "<domain-controller-ip>"
        set password          <service-account-password>
        set smb-ntlmv1-auth disable
        set smbv1 disable
        set logon-history     8
        set polling-frequency 10
    next
end

Important: Agentless mode does not include a native machine account filter. The Collector Agent method (Section 5.1) provides superior control.

Warning: Agentless mode does not support Windows Server 2025 with default Security Event Log polling on Collector Agent versions earlier than 5.0.0328.

Post-remediation verification:

After applying the machine account filter, the following steps confirm correct operation:

1. Restart a domain-joined workstation and monitor FortiGate traffic logs.

2. Execute diagnose debug authd fsso list and confirm that the workstation IP address is not listed with the $ suffix.

3. Allow the workstation user to complete interactive login and confirm that the IP address mapping updates to the correct username.

4. Navigate to Log & Report -> Traffic Log and verify that the User field does not display HOSTNAME$ entries.