Pre-Windows Login

I'm trying to setup Forticlient for Pre-Windows VPN, so the VPN is created before login, so the user auths against AD when logging into the machine. I am setting the clients up through EMS. I've gotten it working, but I still get the option to login without the VPN. I'd like to force them to login with the VPN, to prevent people from logging in with cached credentials. Is this possible with Forticlient?