Fortinac Local Admin account problem

[rcpdkc]

Hello, some users in the domain can access the internet when they enter their own users in the agent after logging into the local admin account. I want to quarantine users who log in with local admin, how can I do this.

[ebilcari]

So these users use the local admin account to login to the PC and when prompted by the agent they enter their AD credentials?

This can be limited by adding a custom Scan and monitor a specific file, a registry value or a certificate that is available only when a domain user is logged in the PC. Some details are covered in this article: Technical Tip: Monitor Custom scans to ensure a quicker response to host compliance