Use case:
A company uses Active Directory for employee authentication and LDAP synchronization in FortiNAC.
Two endpoints are registered:
CORP-LAPTOP-01
PRINTER-01
The laptop is registered using Register as User. The printer is registered using Register as Device.
This article demonstrates how the selected registration method affects endpoint ownership and LDAP group membership.
LDAP synchronization overview:
In this example, Active Directory contains the following group:
Finance
After LDAP synchronization, FortiNAC creates:
Finance_user
Finance_host
Which groups an endpoint becomes associated with depends on the selected registration method and whether a user ownership relationship exists.
To verify the synchronized groups, navigate to:
System -> Groups
Confirm the following groups are present:
Finance_user Member Type: User
Finance_host Member Type: Host
Register as user:
When an endpoint is registered as a User, the host record becomes associated with the authenticated user account.
Captive portal registration:
Connect the endpoint to the network. Authenticate through the Captive Portal. Select Register as User. Complete the registration process.
Manual registration via Admin UI:
Users & Hosts -> Manage Hosts and Ports.
Note: When registering manually through the Administration UI, the option is labeled Register to User. This is equivalent to selecting Register as User through the Captive Portal.
Verification:
Navigate to Users & Hosts -> Hosts.
Open the registered endpoint and verify that a user association exists.
Example:
Because the host is associated with an authenticated user, both user and host relationships can be established.
Example:
Finance_user
 └─ jdoe  Finance_host  └─ CORP-LAPTOP-01
Register as Device:
When an endpoint is registered as a device, FortiNAC creates a host record without creating a user ownership association.
This registration method is typically used for infrastructure and shared devices such as printers, IP phones, cameras, alarm systems, and IoT devices.
Captive portal registration:
Connect the endpoint to the network. Open the registration page. Select Register as Device. Complete the registration process.
Manual registration via admin UI (host view):
Log in to the FortiNAC Administration UI. Navigate to Users & Hosts -> Hosts.
Locate the endpoint. Right-click the host and select Register as Device.
Manual registration via Admin UI (adapter view): Navigate to Users & Hosts -> Adapters.
Locate the adapter. Right-click the adapter and select Register as Device.
Alternative registration method:
Navigate to Users & Hosts -> Manage Hosts and Ports. Select Add Hosts and choose Register as Device.
Navigate to Users & Hosts -> Hosts. Open the registered endpoint and verify that no user association exists.
Example:
Because no user ownership association exists, FortiNAC does not establish the same user-to-host relationship created by the Register as User workflow.
Impact on policy matching:
When LDAP-synchronized groups are used in User/Host Profiles, the selected registration method can influence how membership is evaluated during policy processing.
For example:
Finance_user may be used to identify authenticated finance department users.
Finance_host may be used to identify hosts associated with finance department users.
This distinction becomes important when User/Host Profiles and Network Access Policies rely on LDAP-synchronized groups as matching criteria.
Verification summary:
To verify the registration type of an endpoint, navigate to Users & Hosts -> Hosts. Open the host properties and review the ownership information.
Registration Method | Expected Result | Register as User | Current User field populated | Register as Device | Current User field blank |
Use Register as User when network access decisions should follow the authenticated user's identity. Examples: Corporate laptops. Employee desktops. BYOD smartphones. User-assigned tablets. Student devices.
Use Register as Device when the endpoint is not associated with a specific user, ownership changes frequently, or the device type does not support interactive user authentication.
Examples:
Network printers. IP cameras. Badge readers. VoIP phones. IoT devices. Shared kiosks. Conference room systems. Alarm systems.
Endpoint Type | Recommended Registration | Corporate Laptop | Register as User | Employee Desktop | Register as User | BYOD Device | Register as User | User-Assigned Tablet | Register as User | Student Device | Register as User | Shared Workstation / Kiosk | Register as Device | Network Printer | Register as Device | IP Camera | Register as Device | Badge Reader | Register as Device | VoIP Phone | Register as Device | IoT Sensor / Smart Device | Register as Device | Conference Room System | Register as Device | Alarm System | Register as Device |
Note: If a different registration method is required, the endpoint may need to be re-registered so that ownership information is recreated using the desired registration type.
Result:
Registering an endpoint as a User creates a user-to-device ownership relationship that can be leveraged for user-based policies and LDAP group membership evaluation.
Registering an endpoint as a Device creates a registered host record without a user ownership association and is typically used for infrastructure, shared, or non-interactive endpoints.
Selecting the appropriate registration method during onboarding helps ensure predictable User/Host Profile matching, policy evaluation, and LDAP group membership resolution throughout the endpoint lifecycle.
Related documents: | 
