FSSO CA failing to track user logons

Network setup: FSSO CA installed on a dedicated server, 4 domain controllers each with a DC agent. Domain controllers are 2012 R2, workstations are Windows 7.

Issue: Users logons occasionally fail to get tracked by the FSSO CA. A user will log in to Windows on their workstation but if you search the “Logon Users” in the CA the user does not show up. This causes the user to get web filter blocked by the firewall when visiting websites.

Findings:

Searching the “View Logon Events” log in the CA does not have an entry for the user logging on. The previous entry for that user is their dead entry timeout from the night before.

Searching the domain controller’s event viewer I do find a logon event for the user.

The CA has the default configuration for which event IDs to track (4768 and 4776) http://kb.fortinet.com/kb/viewContent.do?externalId=FD36424&sliceId=1

We are only auditing for event ID 4768, there are no 4776 event IDs present in the domain controller event viewer.

We are currently using the following settings in the CA: “Disable RDP Override” and “Support NTLM authentication”.

We have added all our AD service accounts to the “Ignore User List” in the CA.

I’ve been troubleshooting this with Fortinet support but they have not been able to resolve the issue so far. Currently they want me to verify that the server that hosts the FSSO CA returns the correct computer name and IP when an nslookup is done on the workstation from the server when the problem occurs, I am waiting for the issue to occur again so I can check this. I think the problem is most likely to do with the event IDs we are generating and tracking but I’m not sure how to troubleshoot this.

Any suggestions are appreciated.