Fortinac Check Dns

Hello

I'm not sure to understand what you mean by user's DNS,

but here is how you can quarantine a USER:

• Go to menu Users & Hosts > Hosts
• Right-click on the user(s)
• Click the Disable Users sub menu

On the other hand you can quarantine a HOST this way:

• Users & Hosts > Hosts
• Right-click the host(s)
• Click the Disable sub-menu

Once you do that, the disabled host should go to dead-end/isolation, and any host that the user logs-on will go to dead-end/isolation.

Hello,

well it depends, you can also manually disable that host via host view list or what I can suggest is to use Persistent agent and add custom scan for domain joined users.
https://docs.fortinet.com/document/fortinac/9.4.0/administration-guide/156414/endpoint-compliance

BR

If I understood this correctly, you want to disable port/host in case it uses a DNS other than specified. Since this is not a static configuration value (checked via registry, processes) it can't be identified by the agent scans. It's better to use the Firewall to report this behavior as an incident and than map it to an Action in FNAC to disable the host or mark it as at risk.