No connection after login -> need reboot

Hi,

from attached config it seems that you are using NetAPI polling method only.

Collector will listen to DC/TS Agents but there is not a single agent seen in config, not sure if due to config sanitation before post or because there is no agent installed anywhere on DC.

NetAPI polling is a bit old method and if you do not poll in time then logon loss might happen.

Therefore, if your domain consist of Windows 2008 DCs or newer, I would strongly recommend to switch to WinSec polling, or even to WinSec+WMI polling method. Those methods do not loose logons but if there is too many logons in WinSec log the collector might get slightly behind the rate of logons, but will never loose a logon, just delay its processing.

Poll all the DCs for the respective domain, with RODC exemption.

If you do use DCAgents and they were just removed from presented config, then make sure you have agents installed on all DCs as well. As workstation might choose different logon server then you are reading data from and then you might not see logon.

Successful logon audit needs to be set cross whole domain, via GPO, and applied on all domain DCs.

Then you should spot logon events, not miss any, and process in time.

As result you should have user logon list populated on Collector.

And such logons pushed to connected FortiGates according to Group Filters set (and I would highly recomend to set filters either from Collector side or from FortiGate side [that's what LDAP is used for in FSSO Agent setup]).