Host Adapters Disabled when Registered User is disabled in AD

Hello Sir, 

Can you please explain more, you have disable user in active directory and you want to disable user in firewall ?

FortiGate itself does not directly enable or disable network adapters on endpoints based on Active Directory user status. Instead, FortiGate manages network access and security policies, including user-based policies through FSSO.

Here is the log messages that FortiNAC is performing.

Is it required to do that?

A user account and a host are separate things, I mean when a user is disabled you can still connect from the same host with a different account.

Second thing, when your user is disabled at AD level, the user is not supposed to be able to authenticate on any host, even FNAC can't authenticate it with AD, so FNAC is supposed to keep him isolated, right?

This behavior is by default. There are two options to bypass this:

- Change the host "Registered To" attribute to another user before disabling the user in AD.

- On LDAP configuration in FNAC remove the "Disabled Attribute". This way FNAC will not read this attribute from the next LDAP synchronization and will not take any action for users that are disabled in AD:

More information can be found in the admin guide.