Fortiauthenticator: No events from Domain Controllers / Users getting wrong policy

FGT 500D:  5.2.2

FAC VM: 3.3.1

FSSO on FGT bound to FAC.  FAC set to poll AD.  LDAP configured.  Groups bound on FGT.

Things were generally working OK.  Created GPO to enforce Remote Registry for validation because some domain computers wree "not verified".  Added a couple other objects for some additional administration and rebooted domain controllers during a maint window.  Now FAC sees, and connects to the domain and DCs, but does not show any events.  It "appears" that everything is communicating, but users are not getting policies as per the config.

thoughts?