FSSO creating Issues when taking RDP of other systems using different domain user account

Hi Fortinet Community,

I would like to explain our scenario and seek your advice on an issue we're encountering.

In our environment, we have configured two Domain Controllers (DCs). Each DC has a separate FSSO-DC Agent and a separate FSSO-Collector Agent. In total, we have two collector agents and two DC-agents across our two DCs. We are using the DC Agent Mode, where the DC agent sends logon information (Windows security logon events) to the collector agents.

The issue we're facing occurs when a user (e.g., 'abdul.rehman@example.com') logs into a Windows machine. The user is successfully authenticated by FSSO and gains access to resources according to the Firewall Policies. At this point, we can see in the FortiGate FSSO Users Dashboard that the user 'abdul.rehman@example.com' is listed with the assigned IP address (e.g., '192.168.100.100').

The problem arises when the user attempts to access one of our internal systems (a server or another PC) using the RDP protocol from the same machine where they are already logged in and authenticated. When the user logs in via RDP using a different account (e.g., 'rdp-user@example.com'—an account created specifically for RDP access within the AD network), FortiGate shows that after 2 to 3 seconds of successful RDP logon, the session with 'abdul.rehman@example.com' disappears. Instead, 'rdp-user@example.com' appears with the same IP address '192.168.100.100', even though 'abdul.rehman@example.com' is still logged in. Consequently, 'abdul.rehman@example.com' can no longer access resources until they log off and log back in.

Could you suggest what might be causing this issue and where to start troubleshooting?

• How can we troubleshoot which authentication protocol is being used during these processes?
• Is it possible that this issue is related to NTLM-based authentication?
• Should we consider moving to Kerberos for testing?
• or is there any other issue other than the mentioned ones?

Any insights or guidance on resolving this issue would be greatly appreciated.

Thank you!

#FortiGate #FortiOS #FSSO