SSL Inspection Failure

Hello, 

sorry for my bad english!

I am a newbie in fortigate, i know the sophos and securepoint utms, but i have a question or a problem and i don't know how to solve it! An i hope you can help me! 

My problem is i have build a fsso connector in the fortigate and installed the FFSO Collector Agent on Domaincontroller, we have two DomainControllers, in the Connector Toll i see both DCs and the Fortigate and i see the Users.  In Fortigate under Firewall-Users i see the Users and the Correct SSO_Group which i connect with AD-Group, but sometimes a User who is in the profile restricted_webprofile_with_special_facebook_allow the PC falls in a other IPv4 Policy with no surfing rights!