FSSO with AD.. i think i'm confused

[tk34]

I have FSSO setup on our DC. 

What, on the Fortinet 100D, do i need to setup or enable so I can setup web filtering rules per OU? the docs i'm finding using Google are obviously older than the current version of Fortigate OS I'm running. Which is 5.0 build 4234.

I have, under Use & Device > LDAP Server for groups setup and the DN's set correctly.  However it's not applying those web filtering policies to just that group. Example. Marketing needs access to social media but our call center should not have it. When I apply a web filter profile i created called callcenter under the policy sections.. it doesn't work.

Further more i also have a policy created to block China, it says 0 bytes, but my fail2ban messages tell me we have quite a bit of traffic from china... probably two problems.  The first is the more pressing.  I had this working rather well under my old cisco asa.