FortiClient SSLVPN username and certificate

Hi,

We got a FortiEMS installed (trial) and are looking at rolling out FortiClient to all the clients.

What we ideally would like to see, is a pre-Windows logon thing going on, but we are also using user certificates together with FortiAuthenticator and OTP. And obviously, we can't choose the user cert prior to actually logging into the device.

So we are left with connecting FortiClient _after_ logging into the Windows machine. Is it possible to 

 a) Get a single sign-on functionality with FortiClient, _after_ the user has already logged onto the machine (apart from OTP obviously) - Like a "connect using Windows credentials"-button?

 b) Set a preferred user certificate to be used (They have multiple)

Br Gs