So if I got it correctly then you do have regular user, logging into workstation, but FSSO took from DC that logged on user is Administrator.
That user simply logged into workstation (which is part of domain, joined properly) and did NOT run any app under another domain account. Haven't used 'RunAs..' windows feature. There is no background app/service running under Administrator privileges found on workstation. And user is still reported to domain as Administrator.
Use simple tools on workstation to check what is logged on user and which DC was used to verification.
Then check logons on DC in Windows Security log.
Compare to Collectoragent.log and FortiGate's FSSO records.
That, checked over time, or with test workstation logon when you do observe progress of that logon being processed, should show you where the issue starts.
B.2. Workstation’s output under affected user account ipconfig /all whoami ping -4 -n 2 %logonserver:~2% net use time /T date /T qwinsta sc query RemoteRegistry
B.3. on FortiGate collect output of those commands (log console output to text file, SSH connection preferred over direct console for its speed): get system stat diag debug reset diag debug en diag debug authd fsso server-status diag debug auth fsso list diag fire auth list diag wad user list
Above is part of debug commands set we use in TAC to check SSO. Hope those will help. If not, kindly open standard trouble ticket with TAC and one of us will help you to resolve the situation completely.
