FSSO type question

[jamestiberius]

we have FSSO Agent running on member server, it pollss the AD server.

when looking at Show Logn Users, most of the users show as Type DC-agent, but a few are showing as type EventLog.

can someone tell me why?  my understanding of our setup is it polls the AD server, and those users in certain AD groups are allowed internet based on the group they are in.

so what is EventLog type in that case?

[Muhammad_Haiqal · Accepted solution]

Hi @jamestiberius ,

There are 2 method for FSSO.
Fortigate itself poll from the AD server

vs
Fortigate poll from the DC-Agent which installed on the server.

In your case, maybe you have a combination of it.

[Markus_M]

More info on polling and which node understands what as well as which event IDs are used:

https://community.fortinet.com/t5/FortiAuthenticator/Technical-Tip-Windows-event-IDs-used-by-FSSO-in...