Hello Bobby,
You probably are getting a limitation of FSSO as it use the Active Directory logon events to "map" the user to IP and as Windows select only the fastest interface to the network traffic (actually the one with best metric), than the logon occurs only through one of the interfaces/IP.
You can check if is this locking/unlocking the PC when alternated from wired/wireless (although still have the event reading interval if you are not using the AD Agent).
If you are using 802.1x on Wireless you could "anticipate" the IP detection integrating the Radius Accounting to RSSO, combining RSSO with FSSO to keep Fortigate "aware" of all IP that user have.
If not using 802.1x or the RSSO option is not possible may be enable the CLI option of "set ntlm enable" could reduce the issue as yours users will be asked for authentication if the IP are not mapped on Fortigate. The NTLM popup on browser could be eliminated also adjusting the browser trust to include the FGT address.
Needing anything else, please drop a note!
Regards,
Felicio Santos, CAPM
HP MASE FlexNetwork v1, MCITP 2008 SRV, ENT, ENT Messaging
FTNT FCNSA v5 / MCSE NT,2000,2003 / MCSA 2000,2003,2008+SEC,Office365 / Network+
